65c6ebbf7f88eb8b1a52b6e4e6084f6d0d757988341aeb9c88bd468b08593f3b | Triage

Analysis

max time kernel
116s
max time network
116s
platform
windows10_x64
resource
win10v20201028
submitted
14-12-2020 14:01

Sharing

Report Analysis Logs

General

Target

25872e2993d1d0523d9306afba1114b3.exe
Size

120KB
MD5

25872e2993d1d0523d9306afba1114b3
SHA1

4aaad812d95d7136506849e120022a72ed7f717a
SHA256

65c6ebbf7f88eb8b1a52b6e4e6084f6d0d757988341aeb9c88bd468b08593f3b
SHA512

a60a51bbd31cf7f742307161aaf206e52dcf8a17b6675a7f9263ab1ae3bf2a14226e208a0f0af3a76b5f576aab55bc5d100093fbf62dc685eeda64bd61ab9d49

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1424 756 WerFault.exe 25872e2993d1d0523d9306afba1114b3.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1424 WerFault.exe
Token: SeBackupPrivilege 1424 WerFault.exe
Token: SeDebugPrivilege 1424 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\25872e2993d1d0523d9306afba1114b3.exe
"C:\Users\Admin\AppData\Local\Temp\25872e2993d1d0523d9306afba1114b3.exe"
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 224
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-2-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/1424-3-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download