9c301c48f5db16bfee94ef08013387f2e2a26e29b5533add910f0994a49d37a3 | Triage

Analysis

max time kernel
131s
max time network
133s
platform
windows10_x64
resource
win10
submitted
31-07-2020 12:51

Sharing

Report Analysis Logs

General

Target

PO 31072020.exe
Size

507KB
MD5

3947aeb57f40c78747241975a6f08fc0
SHA1

6baa5eb10e7da8d731a1c111bd6132a5a564edcb
SHA256

9c301c48f5db16bfee94ef08013387f2e2a26e29b5533add910f0994a49d37a3
SHA512

b5870dc49e03fb207b4d8bd989a19bad946ac4de9383498c0b70ac7f42b84aaba465ff5212b615a5543b5443cc497f4b6bd0246c1b08e0befaff9b332d397a02

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3780 2920 WerFault.exe PO 31072020.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3780 WerFault.exe
Token: SeBackupPrivilege 3780 WerFault.exe
Token: SeDebugPrivilege 3780 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO 31072020.exe
"C:\Users\Admin\AppData\Local\Temp\PO 31072020.exe"
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1172
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3780-0-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/3780-1-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download