Analysis
- max time kernel
53s - max time network
113s - platform
windows10_x64 - resource
win10 - submitted
07/10/2020, 10:38
General
- Target b8658d29bc0e694167b67146649e82fb.exe
- Size 875KB
- Sample201007-alprevc6w6
- SHA256 219b5b3cd84cc5d5a7e229ef870b7b18ac8cdc64df5abef4a9f2b3638353932c
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8658d29bc0e694167b67146649e82fb.exe"C:\Users\Admin\AppData\Local\Temp\b8658d29bc0e694167b67146649e82fb.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 11002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1772-9-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/1772-10-0x00000000053A0000-0x00000000053A1000-memory.dmp
memory/2460-0-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/2460-1-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/2460-3-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/2460-4-0x0000000005A50000-0x0000000005A51000-memory.dmp
memory/2460-5-0x0000000005550000-0x0000000005551000-memory.dmp
memory/2460-6-0x0000000005630000-0x0000000005631000-memory.dmp
memory/2460-7-0x0000000005770000-0x0000000005771000-memory.dmp
memory/2460-8-0x0000000007F50000-0x0000000009F4F000-memory.dmp