7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372 | Triage

Analysis

max time kernel
134s
max time network
140s
platform
windows10_x64
resource
win10v20201028
submitted
10-11-2020 06:43

Sharing

Report Analysis Logs

General

Target

7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe
Size

35KB
MD5

957cb1fbad2e60e795f2ece90ef13ba1
SHA1

476e9ebadd00d573ec11621285d21caebf5be249
SHA256

7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372
SHA512

c32701784ffd2be3a38643f18d9b2bc28573f03323130ab0821cad5d892c06c58da30304481cebe31b0bbd4955220b818e668b7b677bbfb21830a1c0bdee349a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	1272	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2900	WerFault.exe
Token: SeBackupPrivilege	2900	WerFault.exe
Token: SeDebugPrivilege	2900	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe
"C:\Users\Admin\AppData\Local\Temp\7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe"
1⤵
PID:1272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 228
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-0-0x0000000004660000-0x0000000004661000-memory.dmp

Filesize
4KB

Download
memory/2900-1-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download