dace2f4b76d741282866cb3e5038e7b2008817ed8f7079d5d764099be01d34bb | Triage

Analysis

max time kernel
147s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
14/07/2020, 13:39

Sharing

Report Analysis Logs

General

Target

KPmhGSHXD1wimFC.exe
Size

992KB
MD5

85ab3d51b6eff203312f462c3fbf9949
SHA1

1d0bc22e301e8f90f34ef3487da286dd34895035
SHA256

dace2f4b76d741282866cb3e5038e7b2008817ed8f7079d5d764099be01d34bb
SHA512

758043f044983be55a9885eae098bf7af99ba714e932734f8444d77684c6874e328af2d5abd0b72e6c8d9e6f5dfe70e943e47632a3b0794a4754d54761cc63b3

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2220	WerFault.exe
Token: SeBackupPrivilege	2220	WerFault.exe
Token: SeDebugPrivilege	2220	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	3768	WerFault.exe	65

C:\Users\Admin\AppData\Local\Temp\KPmhGSHXD1wimFC.exe
"C:\Users\Admin\AppData\Local\Temp\KPmhGSHXD1wimFC.exe"
1⤵
PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 912
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download