b101b46c4af2b0bf121699278385567d8acf726dc94d85d304d86f48312065d2 | Triage

Analysis

max time kernel
119s
max time network
142s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 08:23

Sharing

Report Analysis Logs

General

Target

Company Profile.pif.exe
Size

422KB
MD5

2ee05660e32767c3fdcd4bf9f9fbe515
SHA1

7563bdca95677e3921660f2d3970eee0dc2bb40d
SHA256

b101b46c4af2b0bf121699278385567d8acf726dc94d85d304d86f48312065d2
SHA512

3b4e5953797220f2395e9206e25ced4133cf5a5f513e142748b48f36e92eeb3a663142ecdd1cc5cc55852bed4fc6122df3eb50e4d2aecdcc07f97e39eadfe8b0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3968 1516 WerFault.exe Company Profile.pif.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3968 WerFault.exe
Token: SeBackupPrivilege 3968 WerFault.exe
Token: SeDebugPrivilege 3968 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Company Profile.pif.exe
"C:\Users\Admin\AppData\Local\Temp\Company Profile.pif.exe"
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1152
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3968-0-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3968-1-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/3968-2-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

Filesize
4KB

Download