Analysis
- max time kernel
64s - max time network
125s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/12/2020, 07:26
General
- Target b01352de2d00d21d8a3a0173729eb0aa.exe
- Size 823KB
- Sample201208-jl2gb3wb86
- SHA256 dcb39be80203e5de62b87f99b5fe21eb25556d58c9d654156850995e86f1f4ba
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b01352de2d00d21d8a3a0173729eb0aa.exe"C:\Users\Admin\AppData\Local\Temp\b01352de2d00d21d8a3a0173729eb0aa.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 12362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/740-13-0x00000000047A0000-0x00000000047A1000-memory.dmp
memory/740-14-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/3084-2-0x0000000073940000-0x000000007402E000-memory.dmp
memory/3084-3-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
memory/3084-5-0x00000000055B0000-0x00000000055B1000-memory.dmp
memory/3084-6-0x0000000005B70000-0x0000000005B71000-memory.dmp
memory/3084-7-0x0000000005710000-0x0000000005711000-memory.dmp
memory/3084-8-0x0000000005680000-0x0000000005681000-memory.dmp
memory/3084-9-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/3084-10-0x0000000026A50000-0x0000000046A38000-memory.dmp
memory/3084-11-0x00000000056E0000-0x00000000056E8000-memory.dmp