bc3ad77264762f9b266ab641f391bbb456ef4bc5c27f64b884506eeaa84dfe58 | Triage

Analysis

max time kernel
90s
max time network
99s
platform
windows10_x64
resource
win10
submitted
10-07-2020 07:33

Sharing

Report Analysis Logs

General

Target

RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
Size

450KB
MD5

8f178a002181e9b40cd09e244b61d1c9
SHA1

ea47dfa2d70ee217a9a5c4cf19c66c8a65108fc4
SHA256

bc3ad77264762f9b266ab641f391bbb456ef4bc5c27f64b884506eeaa84dfe58
SHA512

fa15075384a95e57c2077127fbccfc4eeed67d81cf140685c416858a7ca9bc5d310149d0952bf6fbdcfc0db65f7a53d1508edfadd490e69e1333137b5a327d15

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3792	3020	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3792	WerFault.exe
Token: SeBackupPrivilege	3792	WerFault.exe
Token: SeDebugPrivilege	3792	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe
"C:\Users\Admin\AppData\Local\Temp\RF_DHL KULI500796821_PO200000035_SCAN DOCS.exe"
1⤵
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 944
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3792-0-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/3792-1-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download