ecbf82ef4e11ff9f67070d9d27eacc8080fe0baad57d7acc4dc7b417f546ea67 | Triage

Analysis

max time kernel
11s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 22:50

Sharing

Report Analysis Logs

General

Target

ecbf82ef4e11ff9f67070d9d27eacc8080fe0baad57d7acc4dc7b417f546ea67.dll
Size

304KB
MD5

11272013e71815b815f3b8f20c49006d
SHA1

fa1a97c644b26d2b3e104d4eea27f73806153f47
SHA256

ecbf82ef4e11ff9f67070d9d27eacc8080fe0baad57d7acc4dc7b417f546ea67
SHA512

50fe98e496f51467f2126da916bf3349f44c62cfff0cb13fe07a419a13c272bb84b2d39987a27e4028b2054132e3de63babb04149192f678feab3fba5925755e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4820 4632 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 4820 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecbf82ef4e11ff9f67070d9d27eacc8080fe0baad57d7acc4dc7b417f546ea67.dll,#1
1⤵
PID:4632

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4632 -s 216
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4820-0-0x000001C5DC350000-0x000001C5DC351000-memory.dmp

Filesize
4KB

Download
memory/4820-1-0x000001C5DCCC0000-0x000001C5DCCC1000-memory.dmp

Filesize
4KB

Download
memory/4820-2-0x000001C5DCCC0000-0x000001C5DCCC1000-memory.dmp

Filesize
4KB

Download