a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e | Triage

Resubmissions

22-05-2020 23:12

200522-zx87kfkqfx 3

22-05-2020 23:06

200522-l1sckhd8p6 7

Analysis

max time kernel
129s
max time network
62s
platform
windows10_x64
resource
win10v200430
submitted
22-05-2020 23:12

Sharing

Report Analysis Logs

General

Target

gmpopenh264.dll
Size

997KB
MD5

fe3355639648c417e8307c6d051e3e37
SHA1

f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256

1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512

8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 1616 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1980 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gmpopenh264.dll,#1
1⤵
PID:1616
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1616 -s 280
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-0-0x0000019CFD7C0000-0x0000019CFD7C1000-memory.dmp

Filesize
4KB

Download
memory/1980-1-0x0000019CFE630000-0x0000019CFE631000-memory.dmp

Filesize
4KB

Download
memory/1980-2-0x0000019CFE630000-0x0000019CFE631000-memory.dmp

Filesize
4KB

Download