2427c640fc5ca5313c85c5a956571afdb1543d5964d3ce536b61262d73a9eaaa | Triage

Analysis

max time kernel
119s
max time network
117s
platform
windows10_x64
resource
win10
submitted
12-07-2020 08:08

Sharing

Report Analysis Logs

General

Target

UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe
Size

296KB
MD5

8e35b423a18fafd76c7de83fafeae683
SHA1

ccaa813ae4f830e973032f4ed4dff91538efb8d4
SHA256

2427c640fc5ca5313c85c5a956571afdb1543d5964d3ce536b61262d73a9eaaa
SHA512

bdea8bfaedabc5463715c6d99d47a5f849d3eff354e35f65042cf9e0e15769a27b30c4c68f4483de00f524efa0e0b1124379827c0d0a8d115cc2ab4f9d0a136f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3900 3904 WerFault.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3900 WerFault.exe
Token: SeBackupPrivilege 3900 WerFault.exe
Token: SeDebugPrivilege 3900 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe"
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1140
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3900-0-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/3900-1-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download