0b7a0dee5961536b4ffabb9bac761478223e2c7a79e98c866139af60adf9e79b | Triage

Analysis

max time kernel
61s
max time network
122s
platform
windows10_x64
resource
win10v20201028
submitted
11-11-2020 11:11

Sharing

Report Analysis Logs

General

Target

0b7a0dee5961536b4ffabb9bac761478223e2c7a79e98c866139af60adf9e79b.dll
Size

304KB
MD5

10c6b6a828f631799993e66485823fb2
SHA1

68bdf62e533bce4eb2ebc863d03895b090dc09f4
SHA256

0b7a0dee5961536b4ffabb9bac761478223e2c7a79e98c866139af60adf9e79b
SHA512

ae099300aacd6f6109c0d6224b500a9f3dabe4aad3db30b1f71988fa3223163e50fd0b0655bd0f69c79494c09c7e1af3ed60d35a6a61c9434fd054b7014c2faf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5052 4676 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe
5052	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 5052 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b7a0dee5961536b4ffabb9bac761478223e2c7a79e98c866139af60adf9e79b.dll,#1
1⤵
PID:4676

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4676 -s 220
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5052-0-0x000001DDDA010000-0x000001DDDA011000-memory.dmp

Filesize
4KB

Download
memory/5052-1-0x000001DDDA980000-0x000001DDDA981000-memory.dmp

Filesize
4KB

Download
memory/5052-2-0x000001DDDA980000-0x000001DDDA981000-memory.dmp

Filesize
4KB

Download
memory/5052-4-0x000001DDDA980000-0x000001DDDA981000-memory.dmp

Filesize
4KB

Download