Analysis
- max time kernel
136s - max time network
93s - platform
windows10_x64 - resource
win10v200430 - submitted
17/07/2020, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
Designs.bin.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Designs.bin.exe
Resource
win10v200430
0 signatures
0 seconds
General
- Target Designs.bin.exe
- Size 707KB
- Sample200717-pbcbttx65e
- SHA256 c6c8e259d7057e3e45cfc25e08a8a0133a65fa02fcad7f8af0769d37191257b6
- MD5 9c69d5a0f028f4ebe69773dab84e65a3
- SHA1 ab2c066959222216e0c1a3e02efb2bd9b19d385c
- SHA512 55042c82346aa725df2c1427a39f2f668374ec5c44a9283a221d5c6e5d9951a7cbfc2b3721ea6fcb187c3f7c953dbad80183f0175605bd0fda2f2bc6b1703dea
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 2168 3848 WerFault.exe 65 - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2168 WerFault.exe Token: SeBackupPrivilege 2168 WerFault.exe Token: SeDebugPrivilege 2168 WerFault.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe 2168 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Designs.bin.exe"C:\Users\Admin\AppData\Local\Temp\Designs.bin.exe"1⤵PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 9202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2168
-