2019c7273403d1a629738f790efc05365aa6bfe56b39fc9766bac659cd4d34a1 | Triage

Analysis

max time kernel
5s
max time network
46s
platform
windows7_x64
resource
win7v20201028
submitted
11-11-2020 11:00

Sharing

Report Analysis Logs

General

Target

2019c7273403d1a629738f790efc05365aa6bfe56b39fc9766bac659cd4d34a1.dll
Size

192KB
MD5

eafe3d601bb4f8581b0af53d6f0c19dd
SHA1

d9d7a9f7dd9f46f6a258d94f210c690a3c68efa2
SHA256

2019c7273403d1a629738f790efc05365aa6bfe56b39fc9766bac659cd4d34a1
SHA512

543eeebf7024f4ee27a966599439f62df965438bb70cccb6bcdda314d6091331fd21ab07e16a15667b9ca24310ffa9848466f5b2e8abf6e2b4ef88c5ff1e225e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 1256 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1952 WerFault.exe
1952 WerFault.exe
1952 WerFault.exe
1952 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1952 WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1956 wrote to memory of 1256	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1256	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1256	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1256	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1256	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1256	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1256	1956	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 1952	1256	rundll32.exe	WerFault.exe
PID 1256 wrote to memory of 1952	1256	rundll32.exe	WerFault.exe
PID 1256 wrote to memory of 1952	1256	rundll32.exe	WerFault.exe
PID 1256 wrote to memory of 1952	1256	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2019c7273403d1a629738f790efc05365aa6bfe56b39fc9766bac659cd4d34a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2019c7273403d1a629738f790efc05365aa6bfe56b39fc9766bac659cd4d34a1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 244
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-0-0x0000000000000000-mapping.dmp

Download
memory/1256-3-0x0000000000000000-mapping.dmp

Download
memory/1952-1-0x0000000000000000-mapping.dmp

Download
memory/1952-2-0x0000000002060000-0x0000000002071000-memory.dmp

Filesize
68KB

Download
memory/1952-4-0x0000000002810000-0x0000000002821000-memory.dmp

Filesize
68KB

Download