0b3340fb629b9eaa9afc86cf17991f477dc84677ee47dd153a351ccf45ff3dd0 | Triage

Analysis

max time kernel
10s
max time network
106s
platform
windows10_x64
resource
win10v20201028
submitted
11-11-2020 11:00

Sharing

Report Analysis Logs

General

Target

0b3340fb629b9eaa9afc86cf17991f477dc84677ee47dd153a351ccf45ff3dd0.dll
Size

256KB
MD5

3d9524ca28621882a394bfde868ad792
SHA1

d2886ad4a925adf40a20b70862108be09ddedd97
SHA256

0b3340fb629b9eaa9afc86cf17991f477dc84677ee47dd153a351ccf45ff3dd0
SHA512

fd369ae50ac2f3cbfd9e87eccc0a849113cc1dddadfe9350ea91a68021e172fbf04bf76936bf0e00335db0b4ef378810026841ff88a0a1aac8297ffefd370bbc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3904 1160 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3904 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b3340fb629b9eaa9afc86cf17991f477dc84677ee47dd153a351ccf45ff3dd0.dll,#1
1⤵
PID:1160

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1160 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3904-0-0x0000023846C40000-0x0000023846C41000-memory.dmp

Filesize
4KB

Download
memory/3904-1-0x00000238479B0000-0x00000238479B1000-memory.dmp

Filesize
4KB

Download
memory/3904-2-0x00000238479B0000-0x00000238479B1000-memory.dmp

Filesize
4KB

Download