c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721 | Triage

Analysis

max time kernel
11s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
08-11-2020 16:20

Sharing

Report Analysis Logs

General

Target

c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe
Size

168KB
MD5

a07d726334600a2595f3ecefc3257e0c
SHA1

d5227e0fa7351637c826e7a0a32ff8fa2c13c6fd
SHA256

c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721
SHA512

ccb614c40fb158cdb40cbec50d5027b4ca1a7dae9a76b9be9ab59789c8af9cac1d792f8d09fd4cbb3dc365c7810bde65af0b83d810246444c2c426c5da487997

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2420 796 WerFault.exe c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2420 WerFault.exe
Token: SeBackupPrivilege 2420 WerFault.exe
Token: SeDebugPrivilege 2420 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe
"C:\Users\Admin\AppData\Local\Temp\c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe"
1⤵
PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 244
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download