829592e012673599d9aeacc98aec0c0292368e9ac0aea0626ab9dc055be48a00 | Triage

Analysis

max time kernel
61s
max time network
122s
platform
windows10_x64
resource
win10v20201028
submitted
12-11-2020 14:42

Sharing

Report Analysis Logs

General

Target

829592e012673599d9aeacc98aec0c0292368e9ac0aea0626ab9dc055be48a00.dll
Size

256KB
MD5

b9bcd948a7ef1be2cf572a7be800e322
SHA1

ac47e548601a890d3935e616a326a492af8fe182
SHA256

829592e012673599d9aeacc98aec0c0292368e9ac0aea0626ab9dc055be48a00
SHA512

a1826d692fd0fba9752818eb4ac0b17636109111c5ea2bab89f6986ab68a7c765149b5880f66c009a6f4d441a414c3e81d1d0c3b1b466c93dcb91009ff32704e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4992 4680 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 4992 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\829592e012673599d9aeacc98aec0c0292368e9ac0aea0626ab9dc055be48a00.dll,#1
1⤵
PID:4680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4680 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4992-0-0x000002837C340000-0x000002837C341000-memory.dmp

Filesize
4KB

Download
memory/4992-1-0x000002837CFB0000-0x000002837CFB1000-memory.dmp

Filesize
4KB

Download
memory/4992-2-0x000002837CFB0000-0x000002837CFB1000-memory.dmp

Filesize
4KB

Download