d710447b99c5d26cac4643f971557e7d1b792010942ec3a4fc43ada5c02317da | Triage

Analysis

max time kernel
116s
max time network
118s
platform
windows10_x64
resource
win10
submitted
13-07-2020 14:30

Sharing

Report Analysis Logs

General

Target

46H3mT16hDd9iAu.exe
Size

366KB
MD5

05964cb3d5ac0866f255dbff8c3e3d0b
SHA1

b27cdb7d108d9866c21bf2deb539f74acf8c1335
SHA256

d710447b99c5d26cac4643f971557e7d1b792010942ec3a4fc43ada5c02317da
SHA512

cb9b01594cdbf15418e86459e35eaaf3af64d4a9d93b830278c09da665587ad84aa2305779c9e301cda30dfb45c1212aa8d4f313e0fb43b90419d7a9e5e023b5

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	3588	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3940	WerFault.exe
Token: SeBackupPrivilege	3940	WerFault.exe
Token: SeDebugPrivilege	3940	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\46H3mT16hDd9iAu.exe
"C:\Users\Admin\AppData\Local\Temp\46H3mT16hDd9iAu.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1136
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/3940-1-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download