2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493 | Triage

Analysis

max time kernel
112s
max time network
119s
platform
windows7_x64
resource
win7
submitted
13-07-2020 12:34

Sharing

Report Analysis Logs

General

Target

2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe
Size

343KB
MD5

f218d8a2d942f6f5f7b1e648993ce753
SHA1

5fcbd2d04382de6dd21808346997d32e992dd0e8
SHA256

2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493
SHA512

2b3e669b895af84f4bbc25bf4ef644b3f984c4bf9563ab3b7f8c2aa1cb31220f616357f0cf5f9dc6cf8b7e6dc8a6c4b7f0888a3bc6fbc0affc0bba20e6a3a360

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1768 1516 WerFault.exe 2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe

description	pid	process	target process
PID 1516 wrote to memory of 1768	1516	2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe	WerFault.exe
PID 1516 wrote to memory of 1768	1516	2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe	WerFault.exe
PID 1516 wrote to memory of 1768	1516	2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1768 WerFault.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1768 WerFault.exe
1768 WerFault.exe
1768 WerFault.exe
1768 WerFault.exe
1768 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe
"C:\Users\Admin\AppData\Local\Temp\2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1516 -s 892
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-0-0x0000000000000000-mapping.dmp

Download
memory/1768-1-0x0000000001DB0000-0x0000000001DC1000-memory.dmp

Filesize
68KB

Download
memory/1768-2-0x0000000002C10000-0x0000000002C21000-memory.dmp

Filesize
68KB

Download