edc773741982183fbbca2bc01649bdd6904f8aac5392cec6cfcfeab881c1e727 | Triage

Analysis

max time kernel
124s
max time network
127s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 06:09

Sharing

Report Analysis Logs

General

Target

(2020.07.13.exe
Size

154KB
MD5

d8ac268c14e3fec94e2e5d8b4bcb2b10
SHA1

e35f41e58941b087e60e861067bbe98673b98185
SHA256

edc773741982183fbbca2bc01649bdd6904f8aac5392cec6cfcfeab881c1e727
SHA512

c316d05bf2ddf3af51fc051f2ecfa1e422894003a16b6301f10ff7ea05aff7c9bb889b4d5ceb7f9343ea4c532a79f7774dd212e764e2119fc5ebad4941f4e5e7

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2144 2916 WerFault.exe (2020.07.13.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2144 WerFault.exe
Token: SeBackupPrivilege 2144 WerFault.exe
Token: SeDebugPrivilege 2144 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\(2020.07.13.exe
"C:\Users\Admin\AppData\Local\Temp\(2020.07.13.exe"
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 1136
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-0-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/2144-1-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download