fdb0545a95f394689eb6f31b5b18e9d32fa9a11e5dd4817d16db6204c63577ae | Triage

Analysis

max time kernel
126s
max time network
129s
platform
windows10_x64
resource
win10
submitted
13-07-2020 06:54

Sharing

Report Analysis Logs

General

Target

Price Offer.exe
Size

376KB
MD5

fa5199adb6769a93ec34e3eca02b45e2
SHA1

7099f889545a673087f8b22c961dd18f9574b19a
SHA256

fdb0545a95f394689eb6f31b5b18e9d32fa9a11e5dd4817d16db6204c63577ae
SHA512

6174b245b397dd7d2775ba2decf6b5efa92744bbb588162034273f01f9aff857bdb24774bd0886decb5c90db1a0b76567be85eb7ce0a0d2a9469092abdc97549

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1432 3024 WerFault.exe Price Offer.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1432 WerFault.exe
Token: SeBackupPrivilege 1432 WerFault.exe
Token: SeDebugPrivilege 1432 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Price Offer.exe
"C:\Users\Admin\AppData\Local\Temp\Price Offer.exe"
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 1140
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1432-0-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/1432-1-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/1432-2-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download