66e0e592828da25235eccd1a7fdb3138f6acb5ee9d89bb483d8a384ef264a394 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows10_x64
resource
win10
submitted
13-07-2020 11:18

Sharing

Report Analysis Logs

General

Target

DHL-#AWB130501923096.exe
Size

353KB
MD5

91c50c43932cbbf106bb36bc614d053c
SHA1

24e75ba96eaa2a54b1bb55e29ce7ea990e7c7131
SHA256

66e0e592828da25235eccd1a7fdb3138f6acb5ee9d89bb483d8a384ef264a394
SHA512

291e33bc0a4a4e35b834650d129435b8c021f7b1eeda91d45b70764f2a7a12853c632f9f70a0b9780fd2ef4e6c40e2ece42524ef5575f6c3111e1b9eab5ad563

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3844 3044 WerFault.exe DHL-#AWB130501923096.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe
3844	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3844 WerFault.exe
Token: SeBackupPrivilege 3844 WerFault.exe
Token: SeDebugPrivilege 3844 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL-#AWB130501923096.exe
"C:\Users\Admin\AppData\Local\Temp\DHL-#AWB130501923096.exe"
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1140
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3844-0-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/3844-1-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download