829d53beaf477b401883667122b54a965fe974f4c11fb2ba81335c8a13cbcc29 | Triage

Analysis

max time kernel
10s
max time network
104s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 23:12

Sharing

Report Analysis Logs

General

Target

829d53beaf477b401883667122b54a965fe974f4c11fb2ba81335c8a13cbcc29.dll
Size

256KB
MD5

ea8801018764c994eeefd0281a04e9b9
SHA1

46e28b99e7a224366f7bf2c8b60260726d1cb1d7
SHA256

829d53beaf477b401883667122b54a965fe974f4c11fb2ba81335c8a13cbcc29
SHA512

0136bc0866d00c927a4255dc16288a6eacc02df94e2afdd22a25cb1926cec477e7c8102e3a8ca1ea32b21af57ab52ae072cf7c863e94154f712bd329a151999b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

996 4760 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 996 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\829d53beaf477b401883667122b54a965fe974f4c11fb2ba81335c8a13cbcc29.dll,#1
1⤵
PID:4760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4760 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-0-0x00000209A3DC0000-0x00000209A3DC1000-memory.dmp

Filesize
4KB

Download
memory/996-1-0x00000209A4C30000-0x00000209A4C31000-memory.dmp

Filesize
4KB

Download
memory/996-2-0x00000209A4C30000-0x00000209A4C31000-memory.dmp

Filesize
4KB

Download
memory/996-3-0x00000209A4C30000-0x00000209A4C31000-memory.dmp

Filesize
4KB

Download