af4cfb578c47e97ad86519f44ede6ea6f310113198fbbb0ee87cfca3eb904210 | Triage

Analysis

max time kernel
13s
max time network
105s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 22:51

Sharing

Report Analysis Logs

General

Target

af4cfb578c47e97ad86519f44ede6ea6f310113198fbbb0ee87cfca3eb904210.dll
Size

254KB
MD5

7b4a349b37b1c51482b309dff7a8bd91
SHA1

ad15b889245d713165bede637c77149507709aaf
SHA256

af4cfb578c47e97ad86519f44ede6ea6f310113198fbbb0ee87cfca3eb904210
SHA512

691b5063d5b29bd5392fe9bb28657bceb089ec8ce5848a94e196bdfaf6bd2fb49db1b7e7fbca24652f6a88c9c02e34444c12e49f88ca667031e82cd6585b78a5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3984 1100 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3984 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af4cfb578c47e97ad86519f44ede6ea6f310113198fbbb0ee87cfca3eb904210.dll,#1
1⤵
PID:1100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1100 -s 292
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-0-0x000001D60B400000-0x000001D60B401000-memory.dmp

Filesize
4KB

Download
memory/3984-1-0x000001D60C170000-0x000001D60C171000-memory.dmp

Filesize
4KB

Download
memory/3984-2-0x000001D60C170000-0x000001D60C171000-memory.dmp

Filesize
4KB

Download
memory/3984-3-0x000001D60C170000-0x000001D60C171000-memory.dmp

Filesize
4KB

Download