Analysis
-
max time kernel
133s -
max time network
106s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
17-07-2020 05:29
Static task
static1
Behavioral task
behavioral1
Sample
M3WFLelkSqNUdwK.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
M3WFLelkSqNUdwK.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
M3WFLelkSqNUdwK.exe
-
Size
1.1MB
-
MD5
5b1f37d1452a333b6eeeda0d44161a85
-
SHA1
1623fd18d15f385f1bfa78259c9af13226aeaa14
-
SHA256
8b1417b74ac31f2e60a6a9f5ed507caf06026191354ce0e4b6bf0816fd3f512d
-
SHA512
a46cccfcced1bc0ed23a53c2adec39754515e9cef1f29e3fe3f8178c8f276660071e25d7ee11f2b7b2af0d429fca541bbaa56e38623f36479d235fdc6d27ac72
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2888 1300 WerFault.exe 67 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2888 WerFault.exe Token: SeBackupPrivilege 2888 WerFault.exe Token: SeDebugPrivilege 2888 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe"C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe"1⤵PID:1300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 9162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2888
-