4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878 | Triage

Analysis

max time kernel
65s
max time network
116s
platform
windows10_x64
resource
win10
submitted
11-07-2020 06:09

Sharing

Report Analysis Logs

General

Target

4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878.exe
Size

241KB
MD5

5f8de689089e31366591d5e089aad91d
SHA1

365fcdf345e1446f55e9b67b885496776b8f58e8
SHA256

4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878
SHA512

9328257da277f84b1449b2e8bc75525e019370e83c50cc4bca650bb79fdb04304084e64f6919e00895a95d72fe6698a9b576379ed9be0513225fad81b26e922d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3968 2976 WerFault.exe 4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3968 WerFault.exe
Token: SeBackupPrivilege 3968 WerFault.exe
Token: SeDebugPrivilege 3968 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878.exe
"C:\Users\Admin\AppData\Local\Temp\4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878.exe"
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 912
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3968-0-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/3968-1-0x0000000004890000-0x0000000004891000-memory.dmp

Filesize
4KB

Download