c94596dbfbc9fde422a8f6b20fc6e488d9fcd33931e0e2e07430824eeff8a04a | Triage

Analysis

max time kernel
116s
max time network
118s
platform
windows10_x64
resource
win10
submitted
16-07-2020 07:00

Sharing

Report Analysis Logs

General

Target

INV2020.06.09974.DOCX.exe
Size

331KB
MD5

8dc8dd6ff7a50bf1bdcdaeea069a4ae6
SHA1

133cb0200309be4089f1c60ecb9c0db1fb66f551
SHA256

c94596dbfbc9fde422a8f6b20fc6e488d9fcd33931e0e2e07430824eeff8a04a
SHA512

d2bd87fbc8fb5b2f60cafe9b65561647f637853550dd57430e062aae4856ca9984e4246a327d3611d674bdf1fdaebdaf0b3f8f94604d987990a78f708bce11fc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	3544	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3800	WerFault.exe
Token: SeBackupPrivilege	3800	WerFault.exe
Token: SeDebugPrivilege	3800	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\INV2020.06.09974.DOCX.exe
"C:\Users\Admin\AppData\Local\Temp\INV2020.06.09974.DOCX.exe"
1⤵
PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 908
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3800-0-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/3800-1-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download