1c94475216a36fd670d2d6512f4a4347f809847a0491b768f81fa33fa00ccc83 | Triage

Analysis

max time kernel
85s
max time network
111s
platform
windows10_x64
resource
win10v200722
submitted
31-07-2020 12:16

Sharing

Report Analysis Logs

General

Target

Universal310720.exe
Size

490KB
MD5

c5e7345ea96addff57be87be8b772090
SHA1

319b970b907626efe7be298a0c21c52f254cd311
SHA256

1c94475216a36fd670d2d6512f4a4347f809847a0491b768f81fa33fa00ccc83
SHA512

9b506d1bb4fa8a6bd37a9d5f2a8eece5589d138f9cdc78ab6736de376621147c2380798794913dcb45542aa56e351b0eff83d4acf03d27bf5c8a9044b9865f2c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3648 3888 WerFault.exe Universal310720.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe
3648	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3648 WerFault.exe
Token: SeBackupPrivilege 3648 WerFault.exe
Token: SeDebugPrivilege 3648 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Universal310720.exe
"C:\Users\Admin\AppData\Local\Temp\Universal310720.exe"
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1176
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3648-0-0x0000000004120000-0x0000000004121000-memory.dmp

Filesize
4KB

Download
memory/3648-1-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download