80f73360664b173a59e37be245fe1b791a61c74649e6a0f15ae5dc7fb984cfdc | Triage™

Analysis

max time kernel
74s
max time network
117s
platform
windows10_x64
resource
win10
submitted
16/07/2020, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02bb1837b843f982b3a5c49aad515e10.exe
Size 574KB
Sample200716-sps29cn8b2
SHA256 80f73360664b173a59e37be245fe1b791a61c74649e6a0f15ae5dc7fb984cfdc
MD5 02bb1837b843f982b3a5c49aad515e10
SHA1 fffd6fa55112ae2ad0de9d9043567fe7c20f3160
SHA512 ffaa0f09b1478c1e90dbae86c5caf2bc402bc3fa9edd599a8694a267d9620144aec65002b6f79523ff7320e1493fae392eebce43221b6ac40d4cf2be6792b1e7
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3920	3700	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3920	WerFault.exe
Token: SeBackupPrivilege	3920	WerFault.exe
Token: SeDebugPrivilege	3920	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\02bb1837b843f982b3a5c49aad515e10.exe
"C:\Users\Admin\AppData\Local\Temp\02bb1837b843f982b3a5c49aad515e10.exe"
1⤵
PID:3700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 908
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3920-0-0x0000000004420000-0x0000000004421000-memory.dmp

Download