Analysis
-
max time kernel
62s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:27
General
-
Target
file.dll
-
Size
164KB
-
MD5
81d10b00af8c31044ea7aa32e4958625
-
SHA1
2ae88e4d130eb6e57f6b03a8264f11d1a6fdfdcf
-
SHA256
c35f35a9e54f35375bc2f72842d038c4121a5cc6314ac7cbabca6a8dc463cfcd
-
SHA512
aabd830b5a342cbb67fbc76afe9d87acf1088b0309d4350b7bc28ba7d214f2cc667a790cba9e6fd283773180daab37e0d42ef4bacccb4ad1a493fa7675f8bb3e
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 7563⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4716-0-0x0000000000000000-mapping.dmp
-
memory/4716-2-0x0000000000000000-mapping.dmp
-
memory/4716-3-0x0000000000000000-mapping.dmp
-
memory/4716-4-0x0000000000000000-mapping.dmp
-
memory/4716-5-0x0000000000000000-mapping.dmp
-
memory/4716-6-0x0000000000000000-mapping.dmp
-
memory/4716-7-0x0000000000000000-mapping.dmp
-
memory/5108-1-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/5108-9-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/5108-63-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/5108-64-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB