a3009b66e611127884db7d845017ace8c556820e757e97993abc312b62a11ecd | Triage

Analysis

max time kernel
136s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
11-07-2020 08:07

Sharing

Report Analysis Logs

General

Target

a9dadf707b3c20c1921151d4d8bc2a98.exe
Size

520KB
MD5

a9dadf707b3c20c1921151d4d8bc2a98
SHA1

efbf7491ae45132e2d3bd7ca92200c69e1644bc5
SHA256

a3009b66e611127884db7d845017ace8c556820e757e97993abc312b62a11ecd
SHA512

f6090f2014a9f298c8d8d593d8a61733159c28992d9d19c6d4e70afa46a42d1c5f39b689c708e59af9f91f3d85893521e7e086d589118f6662ccefac892e75d1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 3944 WerFault.exe a9dadf707b3c20c1921151d4d8bc2a98.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2264 WerFault.exe
Token: SeBackupPrivilege 2264 WerFault.exe
Token: SeDebugPrivilege 2264 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a9dadf707b3c20c1921151d4d8bc2a98.exe
"C:\Users\Admin\AppData\Local\Temp\a9dadf707b3c20c1921151d4d8bc2a98.exe"
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 896
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-0-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download
memory/2264-1-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download