f1ea6e81b8737e82bdbc34d3ba8dea1adabd59ed9ccf33887cdd5cee10c77c14 | Triage

Analysis

max time kernel
4s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
15-11-2020 23:20

Sharing

Report Analysis Logs

General

Target

f1ea6e81b8737e82bdbc34d3ba8dea1adabd59ed9ccf33887cdd5cee10c77c14.dll
Size

202KB
MD5

9594e6a988795c2985e2455a0a24fae0
SHA1

ef102f247ac255717ae8294944c91508399995c9
SHA256

f1ea6e81b8737e82bdbc34d3ba8dea1adabd59ed9ccf33887cdd5cee10c77c14
SHA512

f4af7e8c3141b2967fb568280352520a61b5ee5d2eba6c9c7d0a48d1f787c7d16e76d9889ccfd7ca837056f6f9e4bf63390b15c0e20052526455bb67c812731b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

904 1324 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

904 WerFault.exe
904 WerFault.exe
904 WerFault.exe
904 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 904 WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1744 wrote to memory of 1324	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1324	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1324	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1324	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1324	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1324	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1324	1744	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 904	1324	rundll32.exe	WerFault.exe
PID 1324 wrote to memory of 904	1324	rundll32.exe	WerFault.exe
PID 1324 wrote to memory of 904	1324	rundll32.exe	WerFault.exe
PID 1324 wrote to memory of 904	1324	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1ea6e81b8737e82bdbc34d3ba8dea1adabd59ed9ccf33887cdd5cee10c77c14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1ea6e81b8737e82bdbc34d3ba8dea1adabd59ed9ccf33887cdd5cee10c77c14.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 244
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-1-0x0000000000000000-mapping.dmp

Download
memory/904-2-0x0000000001E20000-0x0000000001E31000-memory.dmp

Filesize
68KB

Download
memory/904-4-0x00000000027A0000-0x00000000027B1000-memory.dmp

Filesize
68KB

Download
memory/1324-0-0x0000000000000000-mapping.dmp

Download
memory/1324-3-0x0000000000000000-mapping.dmp

Download