85f3f4ff256d8226555c9e7c1c346e32bd12255851d59eaa5ad645e12423519b | Triage

Analysis

max time kernel
146s
max time network
105s
platform
windows10_x64
resource
win10v200430
submitted
13/07/2020, 11:55

Sharing

Report Analysis Logs

General

Target

kcW8HRnu9lJ2Kk7.exe
Size

428KB
MD5

009d626f0527c9cb53fb1e41e2f618a2
SHA1

eb728cdf10cdbb7089769249bca193c15d4b66ea
SHA256

85f3f4ff256d8226555c9e7c1c346e32bd12255851d59eaa5ad645e12423519b
SHA512

dee6fe0590c0d3b0823ee17b0941e23b650826bb6a54a571c732b957c935797ec66f12de974f8039a55c6812699a2b0dfae646b3c4409e79ef9bea321b3220d5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	3768	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2224	WerFault.exe
Token: SeBackupPrivilege	2224	WerFault.exe
Token: SeDebugPrivilege	2224	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe
2224	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\kcW8HRnu9lJ2Kk7.exe
"C:\Users\Admin\AppData\Local\Temp\kcW8HRnu9lJ2Kk7.exe"
1⤵
PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 1160
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/2224-1-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download