Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-11-2020 13:52
Static task
static1
Behavioral task
behavioral1
Sample
f78589df0160b6790ab80478837369c5c7c42b26614291cd53000a8d9de7a23e.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f78589df0160b6790ab80478837369c5c7c42b26614291cd53000a8d9de7a23e.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
f78589df0160b6790ab80478837369c5c7c42b26614291cd53000a8d9de7a23e.dll
-
Size
256KB
-
MD5
bbef69d2df132b209f97ca3e0162e038
-
SHA1
8b6c271d8482bca3969316ea5677c0990c3d5937
-
SHA256
f78589df0160b6790ab80478837369c5c7c42b26614291cd53000a8d9de7a23e
-
SHA512
0a68b41fc67aa24d0ed39cd27990dfe329362fa725325d069fcee8ec623353f2455086a04273be4eb4fcce06abcc848e08488aba4fa6a8a6ec277f2aa92e9df4
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4904 4692 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 4904 WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f78589df0160b6790ab80478837369c5c7c42b26614291cd53000a8d9de7a23e.dll,#11⤵PID:4692
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4692 -s 2922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4904-0-0x00000294E7F00000-0x00000294E7F01000-memory.dmpFilesize
4KB
-
memory/4904-1-0x00000294E8C70000-0x00000294E8C71000-memory.dmpFilesize
4KB
-
memory/4904-2-0x00000294E8C70000-0x00000294E8C71000-memory.dmpFilesize
4KB
-
memory/4904-3-0x00000294E8C70000-0x00000294E8C71000-memory.dmpFilesize
4KB