Analysis
- max time kernel
148s - max time network
108s - platform
windows10_x64 - resource
win10v200430 - submitted
16/07/2020, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
final reminder.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
final reminder.exe
Resource
win10v200430
0 signatures
0 seconds
General
- Target final reminder.exe
- Size 567KB
- Sample200716-mnye6d3wfa
- SHA256 bacd9f9cb9c0f2ac12f70b61102563449a2ca1de047567c66c6733395ce9200a
- MD5 3caa9f85e3ddcf2d22d832744d16a223
- SHA1 493fe2ff12452902cc6dd4397c51ccfb5b43f0c3
- SHA512 0fc877b654d9cd768bdcee53ed1b5129a1ea07a41e55dbaba49448611fa64f0a82c9bb8f194192ea4b6a5bcc3a64049fc9a2ba495baaa17bece577a7e104a5cd
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 2540 3932 WerFault.exe 65 - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2540 WerFault.exe Token: SeBackupPrivilege 2540 WerFault.exe Token: SeDebugPrivilege 2540 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\final reminder.exe"C:\Users\Admin\AppData\Local\Temp\final reminder.exe"1⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 9122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540
-