8aef7422bb8ccc4560fb78875a0fb5d4644108a905febacd2b609012930e5744 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows10_x64
resource
win10
submitted
17-07-2020 05:28

Sharing

Report Analysis Logs

General

Target

5BHHnXWAUJXWYQP.exe
Size

1.3MB
MD5

b9bc024812225caa1d0e78f34e336f6e
SHA1

8c16b59570b5ecd6c411d222de9d0f53d2c83ec0
SHA256

8aef7422bb8ccc4560fb78875a0fb5d4644108a905febacd2b609012930e5744
SHA512

78d974d5e60baa1d5bf3dbd0c1f7b28742f25b2cd58f4bbdd7cafd07d21f5231852d20f499f9fca99a3030b644f7f3ecd1c9dd942f0278cc65011d3212fed272

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	720	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3924	WerFault.exe
Token: SeBackupPrivilege	3924	WerFault.exe
Token: SeDebugPrivilege	3924	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe
"C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe"
1⤵
PID:720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1156
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-0-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3924-1-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3924-3-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download