7a9985a79a8d09029791875e5cdadd03e187d6de041ef726686450dffd42d394 | Triage

Analysis

max time kernel
67s
max time network
90s
platform
windows10_x64
resource
win10
submitted
10-07-2020 16:59

Sharing

Report Analysis Logs

General

Target

EventCYR.exe
Size

689KB
MD5

84ab9e669f58fe3c106bd595938435fb
SHA1

b373bc1d193e4f04d3f6d6edb918dc69bb92d094
SHA256

7a9985a79a8d09029791875e5cdadd03e187d6de041ef726686450dffd42d394
SHA512

709afa35291c1d6b6e612e0e0101c3ab9a6ddb97680b2b26cb636e457d13cf031924afecc192d6c977e9b323e8015f33721e9f472201830624ea2f8f29b47c1d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3212 3536 WerFault.exe EventCYR.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

EventCYR.exeWerFault.exe

pid	process
3536	EventCYR.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe
3212	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

EventCYR.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3536	EventCYR.exe
Token: SeRestorePrivilege	3212	WerFault.exe
Token: SeBackupPrivilege	3212	WerFault.exe
Token: SeDebugPrivilege	3212	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\EventCYR.exe
"C:\Users\Admin\AppData\Local\Temp\EventCYR.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1248
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3212-0-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download
memory/3212-1-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download