b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76 | Triage

Analysis

max time kernel
9s
max time network
111s
platform
windows10_x64
resource
win10
submitted
11-09-2020 09:34

Sharing

Report Analysis Logs

General

Target

b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe
Size

152KB
MD5

050f1503b1e20dab8c467e912ca84e46
SHA1

7873bbe8781ef73bbb4b90870031f7ea35b8b9a2
SHA256

b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76
SHA512

8435a8036bbf1044a714a04a132843c644c38574c832c029d41cb79bb75757c5331b148bf03889c83724af50a7748198f971f7707487b074a29c6828da71551e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	3100	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe
3608	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3608	WerFault.exe
Token: SeBackupPrivilege	3608	WerFault.exe
Token: SeDebugPrivilege	3608	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe
"C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe"
1⤵
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 368
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3608-0-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/3608-1-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download