Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-11-2020 11:34
General
-
Target
a8386ff55256357e5002145b68bc515fa7b2919a675ba17cd58e1e249652b967.exe
-
Size
681KB
-
MD5
847ff4d67d0f422dfecd2c6ddd7c608b
-
SHA1
098ceae739de6868834b6ad238f27bd3a4c46046
-
SHA256
a8386ff55256357e5002145b68bc515fa7b2919a675ba17cd58e1e249652b967
-
SHA512
640a804868c394dd1505ab6b780b74b6d9940689dbe728066b660d4a1af9b451cd5790d75d1bb5466664bec50b663a12fef7b7ae3fb5b9af9d4267b06cf86f91
Score
3/10
Malware Config
Signatures
-
Program crash 13 IoCs
-
Suspicious behavior: EnumeratesProcesses 188 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8386ff55256357e5002145b68bc515fa7b2919a675ba17cd58e1e249652b967.exe"C:\Users\Admin\AppData\Local\Temp\a8386ff55256357e5002145b68bc515fa7b2919a675ba17cd58e1e249652b967.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 8002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 9362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 10842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 10562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 11242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 11082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 12122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 14242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 14042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 16322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 15602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 13842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 15602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/504-52-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/504-55-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/580-1-0x0000000002B80000-0x0000000002B81000-memory.dmpFilesize
4KB
-
memory/580-0-0x0000000000E44000-0x0000000000E45000-memory.dmpFilesize
4KB
-
memory/580-16-0x0000000002CC0000-0x0000000002CC1000-memory.dmpFilesize
4KB
-
memory/580-17-0x0000000002CC0000-0x0000000002CC1000-memory.dmpFilesize
4KB
-
memory/752-12-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/752-15-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/948-59-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/948-56-0x00000000046B0000-0x00000000046B1000-memory.dmpFilesize
4KB
-
memory/1380-29-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/1524-5-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1524-3-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/1524-2-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/2240-30-0x00000000046B0000-0x00000000046B1000-memory.dmpFilesize
4KB
-
memory/2240-35-0x00000000046B0000-0x00000000046B1000-memory.dmpFilesize
4KB
-
memory/2244-21-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/2244-18-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/2260-36-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/2260-39-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/3404-9-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/3404-6-0x00000000046B0000-0x00000000046B1000-memory.dmpFilesize
4KB
-
memory/3676-48-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/3676-51-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/3924-44-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/3924-47-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/3952-43-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/3952-40-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/4088-25-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/4088-22-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB