0c3f82d1f30a53fb34d63ab9ef7a964ee085059941642d0226fd34ba4f3184c6 | Triage

Analysis

max time kernel
77s
max time network
137s
platform
windows10_x64
resource
win10
submitted
11-07-2020 02:46

Sharing

Report Analysis Logs

General

Target

YxaezL5DP1ISnOG.exe
Size

208KB
MD5

4ba613da5bba6b5079b25dce5c6d90fc
SHA1

03365a85123e07eaab5019e92a23cf6d423c81cf
SHA256

0c3f82d1f30a53fb34d63ab9ef7a964ee085059941642d0226fd34ba4f3184c6
SHA512

a6d5ee3ca473473748d2b9a8e1f838b5b25b4d72b3310529a75f2483b847eec27e1118695d53cef0714e02eefdb2b8d71f180721907062f7a7c6ea3f6e44da55

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3028 716 WerFault.exe YxaezL5DP1ISnOG.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3028 WerFault.exe
Token: SeBackupPrivilege 3028 WerFault.exe
Token: SeDebugPrivilege 3028 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\YxaezL5DP1ISnOG.exe
"C:\Users\Admin\AppData\Local\Temp\YxaezL5DP1ISnOG.exe"
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 912
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-0-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3028-1-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3028-4-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download