Analysis
-
max time kernel
117s -
max time network
137s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
13-07-2020 14:35
Static task
static1
Behavioral task
behavioral1
Sample
new shipment.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
new shipment.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
new shipment.exe
-
Size
538KB
-
MD5
3a1635fd14ff9c17c0f65b8c393b9739
-
SHA1
1f6e011d27ab1bbcfb5d57494610327bcf889aeb
-
SHA256
e016bfbd170c4b15789abf7fa2ba30bec2bd785e2ec9b9fc759722833ed88a87
-
SHA512
c37644c6b1ae9bd046d3a98733cd357051d632d926d408fbfc9a327668442b328be0aa5f56de5ebb416d772a1109c45f86aff90ab20c70bea3fd2641913f2211
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3664 2024 WerFault.exe 67 -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3664 WerFault.exe Token: SeBackupPrivilege 3664 WerFault.exe Token: SeDebugPrivilege 3664 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new shipment.exe"C:\Users\Admin\AppData\Local\Temp\new shipment.exe"1⤵PID:2024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 11362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664
-