4052cabc6efdd8910b0c92b973d1a37172a92ee408fc53209d746cfb65e08dcc | Triage

Analysis

max time kernel
128s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
10/07/2020, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PO894749745.exe
Size

441KB
MD5

65fe80a7288aebb3e14c7db814feb974
SHA1

38df46f7e47abefe45503b57474673e8f5e15c24
SHA256

4052cabc6efdd8910b0c92b973d1a37172a92ee408fc53209d746cfb65e08dcc
SHA512

7415b082c8644f3406c743ab65db55e4e34817d380a6638065ac12547451382a0c51f1c921fa3b07df3eb5aaf75a2eb3cc4cddf2407e044023424c1cb5d64122

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3732	WerFault.exe
Token: SeBackupPrivilege	3732	WerFault.exe
Token: SeDebugPrivilege	3732	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe
3732	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	1356	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\PO894749745.exe
"C:\Users\Admin\AppData\Local\Temp\PO894749745.exe"
1⤵
PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 1140
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3732-0-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/3732-1-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download