0a699d50cee9fc3eb46b0703c5502a84fbb357757853e25474683baf8f477fe0 | Triage

Analysis

max time kernel
116s
max time network
118s
platform
windows10_x64
resource
win10
submitted
17/07/2020, 05:28

Sharing

Report Analysis Logs

General

Target

Na4hsgjtrPIobAM.exe
Size

1.2MB
MD5

11bb02cfce17265a128473afd7c40049
SHA1

9232267ebbbdb7599083f3340e4dc4d53fa7f96b
SHA256

0a699d50cee9fc3eb46b0703c5502a84fbb357757853e25474683baf8f477fe0
SHA512

f41eb62ccf52f71d94a9d731f84f16589207d4dd5343ca710b24bc9f3ab9585cd87f5c8eb15c14be810034341db98574c0de22a43f25ccc181201319e87e534c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4036	792	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4036	WerFault.exe
Token: SeBackupPrivilege	4036	WerFault.exe
Token: SeDebugPrivilege	4036	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe
4036	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Na4hsgjtrPIobAM.exe
"C:\Users\Admin\AppData\Local\Temp\Na4hsgjtrPIobAM.exe"
1⤵
PID:792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 920
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4036-1-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/4036-0-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/4036-3-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download