Analysis
- max time kernel
14s - max time network
113s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 06:30
General
- Target MZUIHLHG8ENH1VSI6ANFGAMMQOY5.dll
- Size 11.1MB
- Sample201113-xbjb675cdj
- SHA256 6bd76be4ebf2b1fa8a1580609fb475a10b669baa3d1744eaa58f3ec2df393dad
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MZUIHLHG8ENH1VSI6ANFGAMMQOY5.dll,#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3928 -s 5362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1972-0-0x0000015020FE0000-0x0000015020FE1000-memory.dmp
memory/1972-1-0x0000015021E50000-0x0000015021E51000-memory.dmp
memory/1972-2-0x0000015021E50000-0x0000015021E51000-memory.dmp