2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493 | Triage

Analysis

max time kernel
147s
max time network
65s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 12:34

Sharing

Report Analysis Logs

General

Target

2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe
Size

343KB
MD5

f218d8a2d942f6f5f7b1e648993ce753
SHA1

5fcbd2d04382de6dd21808346997d32e992dd0e8
SHA256

2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493
SHA512

2b3e669b895af84f4bbc25bf4ef644b3f984c4bf9563ab3b7f8c2aa1cb31220f616357f0cf5f9dc6cf8b7e6dc8a6c4b7f0888a3bc6fbc0affc0bba20e6a3a360

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

736 3768 WerFault.exe 2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 736 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe
"C:\Users\Admin\AppData\Local\Temp\2730a12eb9b244a9105af13786a9a5c50dc1c7980bde12f4bced7c87f0480493.exe"
1⤵
PID:3768

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3768 -s 1372
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-0-0x0000016C78790000-0x0000016C78791000-memory.dmp

Filesize
4KB

Download
memory/736-1-0x0000016C794D0000-0x0000016C794D1000-memory.dmp

Filesize
4KB

Download
memory/736-2-0x0000016C794D0000-0x0000016C794D1000-memory.dmp

Filesize
4KB

Download