77650b321630c0c52663e766bd245d28558f5cf11daa55045b9a97f5f3084810

General

Target

77650b321630c0c52663e766bd245d28558f5cf11daa55045b9a97f5f3084810.dll
Size

254KB
MD5

8dd9391ba8edbe49c8634e1506ba9faa
SHA1

d73f98361bc959a6f406a7af5f69ef8c3c0bb4a0
SHA256

77650b321630c0c52663e766bd245d28558f5cf11daa55045b9a97f5f3084810
SHA512

97395cc55476eeecc728cc9f486a55771cf7f1dc9da2488555f5fecfc306fd8e3d521cde44a30444639ff822fe1329c09fc401170e9b1388a923cdc1b4aee79e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3944 1192 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3944	1192	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3944 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	3944	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77650b321630c0c52663e766bd245d28558f5cf11daa55045b9a97f5f3084810.dll,#1
1⤵
PID:1192

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1192 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3944-0-0x000001315F410000-0x000001315F411000-memory.dmp

Filesize
4KB

Download
memory/3944-1-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-2-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-3-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-4-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-5-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-6-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-7-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-8-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-9-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-10-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-11-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-12-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-13-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-14-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-15-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-16-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-18-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-17-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-19-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-20-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-21-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-22-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-23-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-24-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-25-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-26-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download
memory/3944-27-0x00000131601B0000-0x00000131601B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads