cbbdd903cc05a12c3fd5bcf2ab1a651800245e7003fcf6df5a1a7b1c362cf96c | Triage

Analysis

max time kernel
69s
max time network
118s
platform
windows10_x64
resource
win10
submitted
10-07-2020 06:59

Sharing

Report Analysis Logs

General

Target

Order inquiry PO.exe
Size

513KB
MD5

611cc8fb19b8fa6385e76a0095f227f1
SHA1

83b6ed1648133a9e4063942393b5162ee582a804
SHA256

cbbdd903cc05a12c3fd5bcf2ab1a651800245e7003fcf6df5a1a7b1c362cf96c
SHA512

38ee2fb0949cc69b0ec18ce3f66410380d2e0f31c0fea96d3b5322c8ee84b42cd4f12f628aabed1b8a2dc595d30919d4e58999e34f4169979f5a8f6c90300f6e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3380 3868 WerFault.exe Order inquiry PO.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3380 WerFault.exe
Token: SeBackupPrivilege 3380 WerFault.exe
Token: SeDebugPrivilege 3380 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order inquiry PO.exe
"C:\Users\Admin\AppData\Local\Temp\Order inquiry PO.exe"
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 912
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-0-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/3380-1-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/3380-2-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download