Analysis
-
max time kernel
29s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:26
General
-
Target
file.dll
-
Size
166KB
-
MD5
acbd7cf1df4ef4e2c4812747cd443e66
-
SHA1
9e386231a88ffafb3597fddfa909289febf105df
-
SHA256
218ad6e33041a0bdb60c8de03e7dcdf42e5392e106a4b5b0436cdaa02a8dd2c9
-
SHA512
8f116add8d2108ad314221bb4fb77308884c849d8f614f140ca7d989e481b4024afa37a768d20257296c0a6715ca8bb1341081eb896a6045617ea4e403b676f5
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 8763⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3164-0-0x0000000000000000-mapping.dmp
-
memory/3164-2-0x0000000000000000-mapping.dmp
-
memory/3164-3-0x0000000000000000-mapping.dmp
-
memory/3164-6-0x0000000000000000-mapping.dmp
-
memory/3164-5-0x0000000000000000-mapping.dmp
-
memory/3164-4-0x0000000000000000-mapping.dmp
-
memory/3824-1-0x0000000004650000-0x0000000004651000-memory.dmpFilesize
4KB
-
memory/3824-8-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB