a475329b976a2d74fd8a96c33582ff3604dc0cb657a581935ceda83150803834 | Triage

Analysis

max time kernel
129s
max time network
103s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 07:04

Sharing

Report Analysis Logs

General

Target

EyQ4wEdLg3ywEkF.exe
Size

726KB
MD5

b1bf1c95ede331c2110cd65c2141459d
SHA1

230d1d34a497d8549ce3476b1b55ccb5209e3a97
SHA256

a475329b976a2d74fd8a96c33582ff3604dc0cb657a581935ceda83150803834
SHA512

efba63a0c561bbb01ad0abfc6f252bcc8d4cccfe7c2c172e96573d3239dcd17b78c24e2ef87ff74d2b3b5cb6c36dc052fa52df5381781fe80c0ad31a10bc1b50

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2888 1620 WerFault.exe EyQ4wEdLg3ywEkF.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2888 WerFault.exe
Token: SeBackupPrivilege 2888 WerFault.exe
Token: SeDebugPrivilege 2888 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\EyQ4wEdLg3ywEkF.exe
"C:\Users\Admin\AppData\Local\Temp\EyQ4wEdLg3ywEkF.exe"
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 1140
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-0-0x0000000004610000-0x0000000004611000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download