8d9b4ac8385e86b7a40756c1c3d5cb1a7e84cffbb43e242438f8e60ec48e092b | Triage

Analysis

max time kernel
75s
max time network
136s
platform
windows10_x64
resource
win10
submitted
10-07-2020 09:27

Sharing

Report Analysis Logs

General

Target

INV10072020PO67487.exe
Size

416KB
MD5

83ab076e21939b242d02b1c1b89e3097
SHA1

e278bd2d4d9b1e5fc55b448aa4e42506a3e47574
SHA256

8d9b4ac8385e86b7a40756c1c3d5cb1a7e84cffbb43e242438f8e60ec48e092b
SHA512

fef69363cdf8b3c30e1bf0cb992558ee77d2f1326d842768fb20f5c2fff4a14e9def0434965bacf9fd82cb908a342e0fa5af5c5ab9d715899ed734510a5a01fd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3868 3024 WerFault.exe INV10072020PO67487.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3868 WerFault.exe
Token: SeBackupPrivilege 3868 WerFault.exe
Token: SeDebugPrivilege 3868 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\INV10072020PO67487.exe
"C:\Users\Admin\AppData\Local\Temp\INV10072020PO67487.exe"
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 912
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3868-0-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/3868-1-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download