4d304c854141d69a578a006c7982fe1b915f5424b017c46e25ec65301c66f395 | Triage

Analysis

max time kernel
126s
max time network
129s
platform
windows10_x64
resource
win10
submitted
17-07-2020 05:30

Sharing

Report Analysis Logs

General

Target

iYP8D2KbswH1e7i.exe
Size

1.3MB
MD5

71e0fd103027b5403824e1044e2d245e
SHA1

76dee539ecfff078ec10874f07a481b9dd38f8a9
SHA256

4d304c854141d69a578a006c7982fe1b915f5424b017c46e25ec65301c66f395
SHA512

e6a4907f3e9b5c0bf0f96a3fb1b00cf2ce08e22d0e373d093eb1c098c8a87763b8ae949e4dbbbd092a87ebd03be5aafdefe50d3807cabefa32c8fdf23ee64552

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	3832	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3860	WerFault.exe
Token: SeBackupPrivilege	3860	WerFault.exe
Token: SeDebugPrivilege	3860	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe
3860	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\iYP8D2KbswH1e7i.exe
"C:\Users\Admin\AppData\Local\Temp\iYP8D2KbswH1e7i.exe"
1⤵
PID:3832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 1152
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3860-0-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/3860-1-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download