f20b3dc32d42f2f1a64414b5932cc0cb7baf99356445a770a80bf7bed7e144a8 | Triage

Analysis

max time kernel
123s
max time network
127s
platform
windows10_x64
resource
win10
submitted
13/07/2020, 06:29

Sharing

Report Analysis Logs

General

Target

DOCUMENTS.exe
Size

353KB
MD5

2dbc67d0f2fec61676babbd3499ca526
SHA1

0de8d27e60c449d677bd878f5ee1accbe24fba2e
SHA256

f20b3dc32d42f2f1a64414b5932cc0cb7baf99356445a770a80bf7bed7e144a8
SHA512

7dfad2daae014db5bf8c3822051913a90516c9770acf6a33e281290b39ad188268bad0dcdf487413948d7c3be9d94658d28c696465f6b255f6423562246feb9b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3804	3892	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3804	WerFault.exe
Token: SeBackupPrivilege	3804	WerFault.exe
Token: SeDebugPrivilege	3804	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DOCUMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENTS.exe"
1⤵
PID:3892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 1140
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3804-0-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/3804-1-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download