14f166609d8b48d7989f607b7555ca559e95c893c7261bd7935e5fc514869a37 | Triage

Analysis

max time kernel
10s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
05-11-2020 19:08

Sharing

Report Analysis Logs

General

Target

c421e9bd014bb76b698c3389e96942a546e9bc098b9fdca87ed6aae2b7766672.exe
Size

486KB
MD5

fa96e7ef567e26c7f4aeb1e4b2028657
SHA1

0496ed44ea13d844a7bd4c3fcbf8b76db6a886fc
SHA256

c421e9bd014bb76b698c3389e96942a546e9bc098b9fdca87ed6aae2b7766672
SHA512

cf23fa0181f12241c1afecc270b6be70d2ef0b10156956ee5b2fd581e6382e6960f2efad25cf4e083ceae919086f12a3eea02908f2f5d89a971f317415dd2e46

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1800 4636 WerFault.exe c421e9bd014bb76b698c3389e96942a546e9bc098b9fdca87ed6aae2b7766672.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

c421e9bd014bb76b698c3389e96942a546e9bc098b9fdca87ed6aae2b7766672.exeWerFault.exe

pid	process
4636	c421e9bd014bb76b698c3389e96942a546e9bc098b9fdca87ed6aae2b7766672.exe
4636	c421e9bd014bb76b698c3389e96942a546e9bc098b9fdca87ed6aae2b7766672.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1800 WerFault.exe
Token: SeBackupPrivilege 1800 WerFault.exe
Token: SeDebugPrivilege 1800 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c421e9bd014bb76b698c3389e96942a546e9bc098b9fdca87ed6aae2b7766672.exe
"C:\Users\Admin\AppData\Local\Temp\c421e9bd014bb76b698c3389e96942a546e9bc098b9fdca87ed6aae2b7766672.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 376
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-0-0x0000000004890000-0x0000000004891000-memory.dmp

Filesize
4KB

Download
memory/1800-1-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download