970db37b1b904855cd21d80818893f3b1d739dd9ecaaf8a38237c07e0d455d8c | Triage

Analysis

max time kernel
128s
max time network
68s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 17:38

Sharing

Report Analysis Logs

General

Target

RFQ SC0054852_PDF.exe
Size

409KB
MD5

93458cfe349ae4b59a0703d3a62160b9
SHA1

37e01a736df3d2cab4a51412e92df46e7aa18bfa
SHA256

970db37b1b904855cd21d80818893f3b1d739dd9ecaaf8a38237c07e0d455d8c
SHA512

61ae9ba6e4858095b284947831011a4246909e33f6730dab6b9c441c13bcc086389e82e7d8a9e0bce4d9358864f0b12a2b3daaabe3fe4a7e7d42bf6ff5950cf2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1896 1484 WerFault.exe RFQ SC0054852_PDF.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1896 WerFault.exe
Token: SeBackupPrivilege 1896 WerFault.exe
Token: SeDebugPrivilege 1896 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ SC0054852_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ SC0054852_PDF.exe"
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1096
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1896-0-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/1896-1-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download