1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f | Triage

Analysis

max time kernel
114s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
08-11-2020 16:18

Sharing

Report Analysis Logs

General

Target

1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe
Size

202KB
MD5

b0571cacc6330460f1384218b84f1816
SHA1

602eb728a96ea9372a44695ee3ad5100ae8b2543
SHA256

1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f
SHA512

a9f99318f0399cfcb6f55c1f6ecbdb031943c1b31fbcb687afe3dd170c936efa07e03292d60e7532a501ae8797f4a13a8c53611c8e7c0566f2e511e3e2a51e36

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3984 984 WerFault.exe 1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3984 WerFault.exe
Token: SeBackupPrivilege 3984 WerFault.exe
Token: SeDebugPrivilege 3984 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe
"C:\Users\Admin\AppData\Local\Temp\1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe"
1⤵
PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 272
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-0-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/3984-1-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download