90ffeb45522908fa7577b6d949416caf3c1b5de18de690ba7dcfaed387bbdb88 | Triage

Analysis

max time kernel
13s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
11-11-2020 11:08

Sharing

Report Analysis Logs

General

Target

90ffeb45522908fa7577b6d949416caf3c1b5de18de690ba7dcfaed387bbdb88.dll
Size

256KB
MD5

859133cc234225f8038f97e01f30c87f
SHA1

d41dd632b93fdfa6d64434e006ae84781d987fd5
SHA256

90ffeb45522908fa7577b6d949416caf3c1b5de18de690ba7dcfaed387bbdb88
SHA512

91cc6388bbd10a1efa3b4468a7c1e575d84b0cae56fd3097015e25e3b3d6fa5d5c3a19beff89ac0fd8141c617c1916870c7df9b04f7f322349407c6c544e2560

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1044 3372 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe
1044	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1044 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90ffeb45522908fa7577b6d949416caf3c1b5de18de690ba7dcfaed387bbdb88.dll,#1
1⤵
PID:3372

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3372 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-0-0x000001CAAC140000-0x000001CAAC141000-memory.dmp

Filesize
4KB

Download
memory/1044-1-0x000001CAACEB0000-0x000001CAACEB1000-memory.dmp

Filesize
4KB

Download