113ec146b4714b28eeb8d375061503293c07a5b168f980649ca0afd58230bd36 | Triage

Analysis

max time kernel
71s
max time network
126s
platform
windows10_x64
resource
win10v200722
submitted
29-07-2020 06:28

Sharing

Report Analysis Logs

General

Target

DHL File.exe
Size

635KB
MD5

df5e752203a5518f1c381f3e26fa57bc
SHA1

7d978cc0fe63b646f3b2d15ba50e0a9b337e6f62
SHA256

113ec146b4714b28eeb8d375061503293c07a5b168f980649ca0afd58230bd36
SHA512

4828c894282c906b0733291f8241ec745d87d312a96c185fce671adbc46380ed781bbbe9226b4bbfec041ff22ae6ef9771cec5320e1151e43c62bfab2d88da18

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	3952	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2616	WerFault.exe
Token: SeBackupPrivilege	2616	WerFault.exe
Token: SeDebugPrivilege	2616	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL File.exe
"C:\Users\Admin\AppData\Local\Temp\DHL File.exe"
1⤵
PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1120
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-0-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/2616-1-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download