d32e5e98f0b4d284046a50db5237b4326a54943e185b57b0e6e76874479724fe | Triage

Analysis

max time kernel
129s
max time network
124s
platform
windows10_x64
resource
win10
submitted
18-07-2020 14:03

Sharing

Report Analysis Logs

General

Target

RFQ #120032020.exe
Size

732KB
MD5

e1fd408fd5c308ae16133649a522db80
SHA1

218a7bfdb2d1826422773d7a9ba4269b316ed2ae
SHA256

d32e5e98f0b4d284046a50db5237b4326a54943e185b57b0e6e76874479724fe
SHA512

32d7bf5566d4a8716434efd6027e35e92653bf43af5e980f523d96183313a0d47c75429fea3f30d25acd4259285ebd3b67ab2f8abfa8e6d719b65bb5f6a4479b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3816	1656	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3816	WerFault.exe
Token: SeBackupPrivilege	3816	WerFault.exe
Token: SeDebugPrivilege	3816	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ #120032020.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ #120032020.exe"
1⤵
PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 908
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-0-0x00000000045C0000-0x00000000045C1000-memory.dmp

Filesize
4KB

Download
memory/3816-1-0x00000000045C0000-0x00000000045C1000-memory.dmp

Filesize
4KB

Download
memory/3816-3-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download