d907d7da5552b08415af0136f83af0d42d9cfa4c4ebe827a3bcfe3ec4f09e76c | Triage

Analysis

max time kernel
62s
max time network
20s
platform
windows7_x64
resource
win7
submitted
31-07-2020 12:17

Sharing

Report Analysis Logs

General

Target

Shipping Details _PDF.exe
Size

629KB
MD5

80a7df3aa139f95f4d1300cbaa70527c
SHA1

8c525314a2347db926d9ff956d37fb6959d90520
SHA256

d907d7da5552b08415af0136f83af0d42d9cfa4c4ebe827a3bcfe3ec4f09e76c
SHA512

187c437a0980d00181ed30b140ad80780caa9e94cac37c27ee1bfc5fda18f55361d38b1466d7ac4f7622f7016473122b850d16e9f8396dc94a7d71677ca58d9d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 1088 WerFault.exe Shipping Details _PDF.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Shipping Details _PDF.exe

description	pid	process	target process
PID 1088 wrote to memory of 1120	1088	Shipping Details _PDF.exe	WerFault.exe
PID 1088 wrote to memory of 1120	1088	Shipping Details _PDF.exe	WerFault.exe
PID 1088 wrote to memory of 1120	1088	Shipping Details _PDF.exe	WerFault.exe
PID 1088 wrote to memory of 1120	1088	Shipping Details _PDF.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1120 WerFault.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Details _PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Details _PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 736
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1120

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-0-0x0000000000000000-mapping.dmp

Download
memory/1120-1-0x00000000009B0000-0x00000000009C1000-memory.dmp

Filesize
68KB

Download
memory/1120-2-0x0000000002730000-0x0000000002741000-memory.dmp

Filesize
68KB

Download