12b43ed89fe65ad92c68c63b0dffa2d821ef5d1e506762f9a1c281ca624fd964 | Triage

Analysis

max time kernel
122s
max time network
117s
platform
windows10_x64
resource
win10
submitted
15/07/2020, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Quotation for RC outdoor project.exe
Size

1021KB
MD5

c1cffa07ef23947b7a8684350afe040f
SHA1

7281d1fdaee8ec77d52c4ba4dab4e005e5e4559d
SHA256

12b43ed89fe65ad92c68c63b0dffa2d821ef5d1e506762f9a1c281ca624fd964
SHA512

d48928df68b8fb8065dc4d2238266335b142ed57cc02cda423013060e0b36780e20a761434cfb9884b62fb2ce637fbeab5f11a3d0ba9b35efce1b76251ce7cfc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4000	976	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4000	WerFault.exe
Token: SeBackupPrivilege	4000	WerFault.exe
Token: SeDebugPrivilege	4000	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Quotation for RC outdoor project.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation for RC outdoor project.exe"
1⤵
PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 936
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4000-0-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/4000-1-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/4000-2-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download