bec0a2fe9590afbf0a4c5fd15568c59dddd36978769900624c67785e9b0e4363 | Triage

Analysis

max time kernel
137s
max time network
138s
platform
windows10_x64
resource
win10
submitted
10-07-2020 07:23

Sharing

Report Analysis Logs

General

Target

sampl request.exe
Size

879KB
MD5

b9f272bf7b71dd282dc1b7f60ce75dfe
SHA1

a9b1ccf8e78165bd891ef9d78fb9d39946e35901
SHA256

bec0a2fe9590afbf0a4c5fd15568c59dddd36978769900624c67785e9b0e4363
SHA512

5b1cdbaa9c8a01b6157d414fed83dc5e19eec225fa2cb911c5dfdcdd245e0bd81ab8d042eb70a96a483a88e053a92c8a2914faf6f5c0b9b2b45f3cc620263083

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3924 720 WerFault.exe sampl request.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3924 WerFault.exe
Token: SeBackupPrivilege 3924 WerFault.exe
Token: SeDebugPrivilege 3924 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\sampl request.exe
"C:\Users\Admin\AppData\Local\Temp\sampl request.exe"
1⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 912
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-0-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/3924-1-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/3924-2-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download