9561e056e4033c93b6ec61b6bc70cd3c701fadd0b1f47b0269533a2e19f27110 | Triage

Analysis

max time kernel
135s
max time network
137s
platform
windows7_x64
resource
win7v20201028
submitted
11-11-2020 11:12

Sharing

Report Analysis Logs

General

Target

9561e056e4033c93b6ec61b6bc70cd3c701fadd0b1f47b0269533a2e19f27110.dll
Size

304KB
MD5

a5ffe493f9639b1c44164d378bd4f463
SHA1

cdebbe609c1c0634d09ec7535244dd3a10fa6345
SHA256

9561e056e4033c93b6ec61b6bc70cd3c701fadd0b1f47b0269533a2e19f27110
SHA512

467997b4c9276c6e2008e6f1d056d214382bec13e19d5c8939c8ef9c52bb06381b85a02cac416c9d8dd9a37b1d658de864dac03a2b8866d7bf3d4ce2885a1334

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1640 760 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1640 WerFault.exe
1640 WerFault.exe
1640 WerFault.exe
1640 WerFault.exe
1640 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1640 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 760 wrote to memory of 1640	760	rundll32.exe	WerFault.exe
PID 760 wrote to memory of 1640	760	rundll32.exe	WerFault.exe
PID 760 wrote to memory of 1640	760	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9561e056e4033c93b6ec61b6bc70cd3c701fadd0b1f47b0269533a2e19f27110.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 760 -s 56
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-0-0x0000000000000000-mapping.dmp

Download
memory/1640-1-0x0000000001D40000-0x0000000001D51000-memory.dmp

Filesize
68KB

Download
memory/1640-2-0x0000000002640000-0x0000000002651000-memory.dmp

Filesize
68KB

Download
memory/1640-3-0x0000000002640000-0x0000000002651000-memory.dmp

Filesize
68KB

Download