57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad | Triage

Analysis

max time kernel
126s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 12:10

Sharing

Report Analysis Logs

General

Target

57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad.exe
Size

154KB
MD5

2e107acd5b8ed0e66c5fee0513ace7c1
SHA1

94fc8fd5e841283747390f80583392dc85f845bb
SHA256

57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad
SHA512

93d27f39f10a4c5c27adba3e1bd06a2189d36d2bf8e3250585733ec80d7d783daa09e5c9ea2264a4458adc972b4ef702736058b45e9e38ac064c341c535bed26

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3596	1612	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3596	WerFault.exe
Token: SeBackupPrivilege	3596	WerFault.exe
Token: SeDebugPrivilege	3596	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe
3596	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad.exe
"C:\Users\Admin\AppData\Local\Temp\57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad.exe"
1⤵
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1136
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-0-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/3596-1-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download