799f02ac69cb8e3435d97aa0b13e5d0c53a926751bb5ae337cd3bb45d18d0752 | Triage

Analysis

max time kernel
147s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
10/07/2020, 05:50

Sharing

Report Analysis Logs

General

Target

Scan_doc_inv_199830992.exe
Size

547KB
MD5

887d35132289eb2285cdbca3f6e63238
SHA1

5f4d8542f0d7a34d82587330f9b0aad495b62cd3
SHA256

799f02ac69cb8e3435d97aa0b13e5d0c53a926751bb5ae337cd3bb45d18d0752
SHA512

dd29bcfdfb668695262074dc60dac96faba1ea29142d75ebae35b105afa016507b7776112f0bedf610070f02b6e02e1d412e994a88735318b2b408bb321c30e7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	3692	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2496	WerFault.exe
Token: SeBackupPrivilege	2496	WerFault.exe
Token: SeDebugPrivilege	2496	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Scan_doc_inv_199830992.exe
"C:\Users\Admin\AppData\Local\Temp\Scan_doc_inv_199830992.exe"
1⤵
PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 924
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2496-1-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download