57c0d780e0e67485183d1d4319858244d58555effc7b4e5eb73b6d86e9c6a9d1 | Triage

Analysis

max time kernel
10s
max time network
105s
platform
windows10_x64
resource
win10v20201028
submitted
12-11-2020 13:58

Sharing

Report Analysis Logs

General

Target

57c0d780e0e67485183d1d4319858244d58555effc7b4e5eb73b6d86e9c6a9d1.dll
Size

254KB
MD5

76828770db6f9633f3fbefe6d61d0df8
SHA1

7259970e1240dfb42ab54b0aa9f2cc25be3be535
SHA256

57c0d780e0e67485183d1d4319858244d58555effc7b4e5eb73b6d86e9c6a9d1
SHA512

d7452471e92bbc8330f34b61f05fe31fa32da5fa2421fc122c3e30fecd3c1105b911c6158aebe334ed371976e8f06afc643d272d90031a7ceee0c8aa3dcf9604

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 636 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1476 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57c0d780e0e67485183d1d4319858244d58555effc7b4e5eb73b6d86e9c6a9d1.dll,#1
1⤵
PID:636

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 636 -s 300
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-0-0x00000232203C0000-0x00000232203C1000-memory.dmp

Filesize
4KB

Download
memory/1476-1-0x0000023221230000-0x0000023221231000-memory.dmp

Filesize
4KB

Download
memory/1476-2-0x0000023221230000-0x0000023221231000-memory.dmp

Filesize
4KB

Download