9aa09beb9797b5ae4b2f80937442a013a32e78cfa8b59838cf364a53d65f71bc | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows10_x64
resource
win10
submitted
13-07-2020 07:52

Sharing

Report Analysis Logs

General

Target

SOA- Feb2020 to Jun2020.exe
Size

324KB
MD5

c77edf13eafc541ba8bfdfebf7e5aa9b
SHA1

4ceb14f6732f5f6a530623941e83ae1a49379cd6
SHA256

9aa09beb9797b5ae4b2f80937442a013a32e78cfa8b59838cf364a53d65f71bc
SHA512

ca6d3ab46bee1b43e829f0257921baf61681092644a908bab1840ce64de18a6343fce600611794dc802c448ef6365775f76a69a50050c50d2d0809762d3dcdcd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1840 3060 WerFault.exe SOA- Feb2020 to Jun2020.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1840 WerFault.exe
Token: SeBackupPrivilege 1840 WerFault.exe
Token: SeDebugPrivilege 1840 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SOA- Feb2020 to Jun2020.exe
"C:\Users\Admin\AppData\Local\Temp\SOA- Feb2020 to Jun2020.exe"
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1140
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-0-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/1840-1-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download