3bc965656d4d37e6200dc74776ec7bc20ba882d12ab8afaaa0f537860d9e8147 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows10_x64
resource
win10
submitted
31-07-2020 12:18

Sharing

Report Analysis Logs

General

Target

Purchase Order No PO 004 SFA01 07_31_2020.exe
Size

626KB
MD5

435f458431cc09ed2f1e742ed75b35fa
SHA1

68626fee0e2c2556ac5ebecef5d586e34935328c
SHA256

3bc965656d4d37e6200dc74776ec7bc20ba882d12ab8afaaa0f537860d9e8147
SHA512

9bae8d3756ff393bf79d1bb262858d03e40a6b1a1d87b5630d7585e0f463ab8efc63514b02dd4a44744f5c13e805d10cf76d3f18b094eef99ff0d7bee32907d3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3936 3060 WerFault.exe Purchase Order No PO 004 SFA01 07_31_2020.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3936 WerFault.exe
Token: SeBackupPrivilege 3936 WerFault.exe
Token: SeDebugPrivilege 3936 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order No PO 004 SFA01 07_31_2020.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order No PO 004 SFA01 07_31_2020.exe"
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1176
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3936-0-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/3936-1-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download