7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f | Triage

Analysis

max time kernel
65s
max time network
110s
platform
windows10_x64
resource
win10
submitted
14-07-2020 13:38

Sharing

Report Analysis Logs

General

Target

wBn3alSjAhQUdu5.exe
Size

1002KB
MD5

6a9d67850b1e7768e65877a1aae6ffc6
SHA1

5667a805545fa50a203a5fd4dc01a3615b5bf646
SHA256

7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f
SHA512

92c85a6f54b2c1607095af63c47b359e72eead1f58f69121bbfa9c76dd287d28a6ebdc4ff1cb71e7113fdffdf6559f3c95388b48328e53d1e0a6777b0d133f1c

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3968 3588 WerFault.exe wBn3alSjAhQUdu5.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3968 WerFault.exe
Token: SeBackupPrivilege 3968 WerFault.exe
Token: SeDebugPrivilege 3968 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\wBn3alSjAhQUdu5.exe
"C:\Users\Admin\AppData\Local\Temp\wBn3alSjAhQUdu5.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 904
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3968-0-0x0000000004550000-0x0000000004551000-memory.dmp

Filesize
4KB

Download