Analysis
-
max time kernel
3s -
max time network
16s -
platform
windows7_x64 -
resource
win7 -
submitted
20-09-2020 15:28
Static task
static1
Behavioral task
behavioral1
Sample
6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe
-
Size
65KB
-
MD5
9998fdf06c91184c9269fd16ce6a4a8c
-
SHA1
2d94aa824c39cf20973daccdbf069fb6bffcc36a
-
SHA256
6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262
-
SHA512
c1236f9db35f6d41a1250d2091fecc4e1b350d60c9de495b02f6a03877acab5e11279ccd4cd8eb3a27f740ddae83b6b3062b2d25e0d9252d9dbd79aba065fa98
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1652 1156 WerFault.exe 6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1652 WerFault.exe 1652 WerFault.exe 1652 WerFault.exe 1652 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1652 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exedescription pid process target process PID 1156 wrote to memory of 1652 1156 6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe WerFault.exe PID 1156 wrote to memory of 1652 1156 6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe WerFault.exe PID 1156 wrote to memory of 1652 1156 6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe WerFault.exe PID 1156 wrote to memory of 1652 1156 6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe"C:\Users\Admin\AppData\Local\Temp\6bc0d0292242de6b00ec7ea6a78b00c8ca764b1f605ed49f864ba2e916ec9262.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken