Analysis
- max time kernel
2s - max time network
12s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 06:30
General
- Target MZUIHLHG8ENH1VSI6ANFGAMMQOY5.dll
- Size 11.1MB
- Sample201113-xbjb675cdj
- SHA256 6bd76be4ebf2b1fa8a1580609fb475a10b669baa3d1744eaa58f3ec2df393dad
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MZUIHLHG8ENH1VSI6ANFGAMMQOY5.dll,#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 764 -s 2322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-1-0x0000000001F20000-0x0000000001F31000-memory.dmp
memory/1124-2-0x0000000002D40000-0x0000000002D51000-memory.dmp