9742adf8c511be66c57c236b2849338090c3b7cc0f7ac13f5ff14cdcbfe19912 | Triage

Analysis

max time kernel
129s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 06:09

Sharing

Report Analysis Logs

General

Target

9742adf8c511be66c57c236b2849338090c3b7cc0f7ac13f5ff14cdcbfe19912.exe
Size

251KB
MD5

09c2c6e212675f9a716af51853a74aba
SHA1

a443db12216d17d224f831080b4b4f76967c1e9c
SHA256

9742adf8c511be66c57c236b2849338090c3b7cc0f7ac13f5ff14cdcbfe19912
SHA512

a18a1e6ab993a4390f66afb8d531d22312c86b0a51d6bc22f9984f80b28a83fe062b227892fb8813197000480f91cac08a4080af6db36155bad6952dc33eb4a1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	1600	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2828	WerFault.exe
Token: SeBackupPrivilege	2828	WerFault.exe
Token: SeDebugPrivilege	2828	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9742adf8c511be66c57c236b2849338090c3b7cc0f7ac13f5ff14cdcbfe19912.exe
"C:\Users\Admin\AppData\Local\Temp\9742adf8c511be66c57c236b2849338090c3b7cc0f7ac13f5ff14cdcbfe19912.exe"
1⤵
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 916
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x00000000045D0000-0x00000000045D1000-memory.dmp

Filesize
4KB

Download
memory/2828-2-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download