54ac34141e0dbc8034bce7b1f7aa0a48511f82185e5ddde5ab7dd7c0add7e37c | Triage

Analysis

max time kernel
146s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 06:28

Sharing

Report Analysis Logs

General

Target

p05644371290659.exe
Size

365KB
MD5

70e8ab646c86cd5f01f3e0f7bd759e0b
SHA1

6793b6f23ea8589b094eb203c906ee818f2d930e
SHA256

54ac34141e0dbc8034bce7b1f7aa0a48511f82185e5ddde5ab7dd7c0add7e37c
SHA512

0a988a4cb6685c1808e30938f470c3bcc85cccec2b9a9ef3ffad786b087a165e9a31f6c05a649ee8106a4048aae9ae38aa9c787187cd8bc8dd7bb589b54b7354

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	3008	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1884	WerFault.exe
Token: SeBackupPrivilege	1884	WerFault.exe
Token: SeDebugPrivilege	1884	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\p05644371290659.exe
"C:\Users\Admin\AppData\Local\Temp\p05644371290659.exe"
1⤵
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 1136
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-0-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/1884-1-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download