b2a788fd71a0f4b05dca86d0b8d44abd718261d0fe9cb2f6a947b87987d11cd1 | Triage

Analysis

max time kernel
133s
max time network
146s
platform
windows10_x64
resource
win10v200430
submitted
14/07/2020, 06:02

Sharing

Report Analysis Logs

General

Target

b2a788fd71a0f4b05dca86d0b8d44abd718261d0fe9cb2f6a947b87987d11cd1.exe
Size

247KB
MD5

8f735d36e0240f220f8bedcfc4adcdf7
SHA1

a589c8010e4ac4c22b94e9bde1f8cac3f9603aaf
SHA256

b2a788fd71a0f4b05dca86d0b8d44abd718261d0fe9cb2f6a947b87987d11cd1
SHA512

35361fe229dac4e96e526b033a3e0f2ca90a8f13130a2635b15ebaeb345f9d717cc5c42994eac7c986901456e820caefcc9bd50cdbec83e7e06da68d16f4174c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2536	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2656	WerFault.exe
Token: SeBackupPrivilege	2656	WerFault.exe
Token: SeDebugPrivilege	2656	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b2a788fd71a0f4b05dca86d0b8d44abd718261d0fe9cb2f6a947b87987d11cd1.exe
"C:\Users\Admin\AppData\Local\Temp\b2a788fd71a0f4b05dca86d0b8d44abd718261d0fe9cb2f6a947b87987d11cd1.exe"
1⤵
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 1140
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/2656-1-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/2656-2-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download