d9439aa56b6280ff50bc666ae94cdbfd6d174dda46187dbd0de25e9aeb6edbfb | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows10_x64
resource
win10
submitted
31-07-2020 11:03

Sharing

Report Analysis Logs

General

Target

7a2e8d3fe9752412bf4de2e369d212ee.exe
Size

288KB
MD5

7a2e8d3fe9752412bf4de2e369d212ee
SHA1

02be732190a9828c1900659817f6a3db899fb3a0
SHA256

d9439aa56b6280ff50bc666ae94cdbfd6d174dda46187dbd0de25e9aeb6edbfb
SHA512

ba9cc252858e8c30dc6bd146e85d7a253cc8e391d4d50bd249ee65b1da5c4789bb354179788958add0dbea21801a2070fdd7870db2beaef60906645c10145a8e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3852 3608 WerFault.exe 7a2e8d3fe9752412bf4de2e369d212ee.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3852 WerFault.exe
Token: SeBackupPrivilege 3852 WerFault.exe
Token: SeDebugPrivilege 3852 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7a2e8d3fe9752412bf4de2e369d212ee.exe
"C:\Users\Admin\AppData\Local\Temp\7a2e8d3fe9752412bf4de2e369d212ee.exe"
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 1168
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-0-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download