12027e9572326109ce9621432da2ff4b5f170ffaec2aa118a492349f2c320c4e | Triage

Analysis

max time kernel
127s
max time network
150s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 17:46

Sharing

Report Analysis Logs

General

Target

Purchase order- 932.exe
Size

551KB
MD5

21c6a2f2c3517d9180799fc892758630
SHA1

231126b687dfc1d0c9a433ced44a0ff500670a64
SHA256

12027e9572326109ce9621432da2ff4b5f170ffaec2aa118a492349f2c320c4e
SHA512

c86516123f7ac464cf7d7027ce5ad889a38d5c8b4f7ad34fd3c3cf3cc300fdee53b6e9839a638725b773ff29cafd1f70147b42187fa15ca7acae8db00884b6ce

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2840 1628 WerFault.exe Purchase order- 932.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2840 WerFault.exe
Token: SeBackupPrivilege 2840 WerFault.exe
Token: SeDebugPrivilege 2840 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Purchase order- 932.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase order- 932.exe"
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 900
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-0-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download