452413e4c1ae53679f676ea7e97a7f98697ee833896c6119bc6d8bf15cf06fba | Triage

Analysis

max time kernel
131s
max time network
133s
platform
windows10_x64
resource
win10
submitted
13-07-2020 08:34

Sharing

Report Analysis Logs

General

Target

SOA - 13-07-2020.exe
Size

702KB
MD5

7afce2776cafbc31ae2ea92059d9a78c
SHA1

1afcaa6c26a2e8ea5349c92717c9b92131eef371
SHA256

452413e4c1ae53679f676ea7e97a7f98697ee833896c6119bc6d8bf15cf06fba
SHA512

343ab30e8486eef5ab53390ee44f67260ef3b0a87baba7ee30d7b5671514a020b0d9e58f7d96835e297e4ed5cbc4ee25b7d9c0b5704f241ddbbc6e5c4de456ef

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3776 WerFault.exe
Token: SeBackupPrivilege 3776 WerFault.exe
Token: SeDebugPrivilege 3776 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3776 2920 WerFault.exe SOA - 13-07-2020.exe

C:\Users\Admin\AppData\Local\Temp\SOA - 13-07-2020.exe
"C:\Users\Admin\AppData\Local\Temp\SOA - 13-07-2020.exe"
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1140
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3776-0-0x0000000004240000-0x0000000004241000-memory.dmp

Filesize
4KB

Download
memory/3776-1-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download