Analysis
- max time kernel
65s - max time network
127s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/12/2020, 16:18
General
- Target 52bb0bf42d2f05fb6a9a1ce69a082982.exe
- Size 1002KB
- Sample201208-437cc3vxa2
- SHA256 9908fa5b6b2cc9c84494474cc42668dfb4c03abaa06d79451742ef9eb5c4543f
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52bb0bf42d2f05fb6a9a1ce69a082982.exe"C:\Users\Admin\AppData\Local\Temp\52bb0bf42d2f05fb6a9a1ce69a082982.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 12522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/644-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/644-3-0x0000000000530000-0x0000000000531000-memory.dmp
memory/644-5-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/644-6-0x0000000005470000-0x0000000005471000-memory.dmp
memory/644-7-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/644-8-0x0000000005970000-0x0000000005971000-memory.dmp
memory/644-9-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/644-10-0x0000000005180000-0x0000000005181000-memory.dmp
memory/644-11-0x00000000266B0000-0x0000000046698000-memory.dmp
memory/644-12-0x0000000000CE0000-0x0000000000CE8000-memory.dmp
memory/3368-14-0x0000000004240000-0x0000000004241000-memory.dmp
memory/3368-17-0x0000000004AF0000-0x0000000004AF1000-memory.dmp