f23fd2fe422f7a15283b6fb92ee86b0934d95c61510a2f0209eb26205a21a3a4 | Triage

Analysis

max time kernel
13s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
12-11-2020 14:21

Sharing

Report Analysis Logs

General

Target

f23fd2fe422f7a15283b6fb92ee86b0934d95c61510a2f0209eb26205a21a3a4.dll
Size

254KB
MD5

9ddb87d20b7c0f130f716423b54dad81
SHA1

27575ecf00b4d7313e1d480bbca5910add3469d1
SHA256

f23fd2fe422f7a15283b6fb92ee86b0934d95c61510a2f0209eb26205a21a3a4
SHA512

38295e88bba71781be8f93c08ba02484ae3e4228d57de995e2d4947bab28515c8e4ff90f76faf6bcd43cf9195688c985b67c31c7966d27c18b19d5d7b23acc7b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2384 656 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2384 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f23fd2fe422f7a15283b6fb92ee86b0934d95c61510a2f0209eb26205a21a3a4.dll,#1
1⤵
PID:656

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 656 -s 296
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x00000228B77D0000-0x00000228B77D1000-memory.dmp

Filesize
4KB

Download
memory/2384-1-0x00000228B8540000-0x00000228B8541000-memory.dmp

Filesize
4KB

Download
memory/2384-2-0x00000228B8540000-0x00000228B8541000-memory.dmp

Filesize
4KB

Download