24664c11778ac8e24496f50e8428a1ba88efb9e5459d2ab42237ce0801471f45 | Triage

Analysis

max time kernel
114s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 22:38

Sharing

Report Analysis Logs

General

Target

24664c11778ac8e24496f50e8428a1ba88efb9e5459d2ab42237ce0801471f45.dll
Size

304KB
MD5

c083bdae59044dd8587025696b5bd146
SHA1

9d8f7d44c58de10c5fa0e3d9476b52f732e29d4a
SHA256

24664c11778ac8e24496f50e8428a1ba88efb9e5459d2ab42237ce0801471f45
SHA512

bd2c37cff833b25be3e521da47709949182e8e0dcf0e1ce19fdaba828916a3112bc130ad5df0cfc652d590cd73b2bc042e1337b4eb41af18231bae190716a87f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5008 4688 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe
5008	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 5008 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24664c11778ac8e24496f50e8428a1ba88efb9e5459d2ab42237ce0801471f45.dll,#1
1⤵
PID:4688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4688 -s 220
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5008-0-0x0000020F08CE0000-0x0000020F08CE1000-memory.dmp

Filesize
4KB

Download
memory/5008-1-0x0000020F09650000-0x0000020F09651000-memory.dmp

Filesize
4KB

Download
memory/5008-2-0x0000020F09650000-0x0000020F09651000-memory.dmp

Filesize
4KB

Download