9561e056e4033c93b6ec61b6bc70cd3c701fadd0b1f47b0269533a2e19f27110 | Triage

Analysis

max time kernel
11s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
11-11-2020 11:12

Sharing

Report Analysis Logs

General

Target

9561e056e4033c93b6ec61b6bc70cd3c701fadd0b1f47b0269533a2e19f27110.dll
Size

304KB
MD5

a5ffe493f9639b1c44164d378bd4f463
SHA1

cdebbe609c1c0634d09ec7535244dd3a10fa6345
SHA256

9561e056e4033c93b6ec61b6bc70cd3c701fadd0b1f47b0269533a2e19f27110
SHA512

467997b4c9276c6e2008e6f1d056d214382bec13e19d5c8939c8ef9c52bb06381b85a02cac416c9d8dd9a37b1d658de864dac03a2b8866d7bf3d4ce2885a1334

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

8 4076 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 8 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9561e056e4033c93b6ec61b6bc70cd3c701fadd0b1f47b0269533a2e19f27110.dll,#1
1⤵
PID:4076

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4076 -s 220
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-0-0x00000226B0AF0000-0x00000226B0AF1000-memory.dmp

Filesize
4KB

Download
memory/8-1-0x00000226B1560000-0x00000226B1561000-memory.dmp

Filesize
4KB

Download
memory/8-2-0x00000226B1560000-0x00000226B1561000-memory.dmp

Filesize
4KB

Download