51d9993db6088b6817645cc0054e62926e4f249cb405ae05355a6d4520a46525 | Triage

Analysis

max time kernel
145s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 11:08

Sharing

Report Analysis Logs

General

Target

Detalhes da conta bancÃ¡ria.exe
Size

990KB
MD5

4171abbcb366d00815bc70c1c794a703
SHA1

e23ea5b6598855dd7959829a4ab35d766d1f843c
SHA256

51d9993db6088b6817645cc0054e62926e4f249cb405ae05355a6d4520a46525
SHA512

726ff167bf0dd2f333fe744bca06bfb741629ee45e2e886d2971dbe200de4ff94fc094b15fcbe1e7353457609b3e6e743afd675c79e4554b7bf2fe30eb0d346b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2596 3544 WerFault.exe Detalhes da conta bancÃ¡ria.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2596 WerFault.exe
Token: SeBackupPrivilege 2596 WerFault.exe
Token: SeDebugPrivilege 2596 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe
2596	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Detalhes da conta bancÃ¡ria.exe
"C:\Users\Admin\AppData\Local\Temp\Detalhes da conta bancÃ¡ria.exe"
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 944
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-0-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/2596-1-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download