7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f | Triage

Analysis

max time kernel
114s
max time network
134s
platform
windows10_x64
resource
win10v200430
submitted
14-07-2020 13:38

Sharing

Report Analysis Logs

General

Target

wBn3alSjAhQUdu5.exe
Size

1002KB
MD5

6a9d67850b1e7768e65877a1aae6ffc6
SHA1

5667a805545fa50a203a5fd4dc01a3615b5bf646
SHA256

7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f
SHA512

92c85a6f54b2c1607095af63c47b359e72eead1f58f69121bbfa9c76dd287d28a6ebdc4ff1cb71e7113fdffdf6559f3c95388b48328e53d1e0a6777b0d133f1c

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3752	2532	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3752	WerFault.exe
Token: SeBackupPrivilege	3752	WerFault.exe
Token: SeDebugPrivilege	3752	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\wBn3alSjAhQUdu5.exe
"C:\Users\Admin\AppData\Local\Temp\wBn3alSjAhQUdu5.exe"
1⤵
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 908
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3752-0-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/3752-1-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/3752-3-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download