17c5ff6458dda433431390ed6fde5919db0fb10dd6f201692541f6c90e5f21b5 | Triage

Analysis

max time kernel
13s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 22:50

Sharing

Report Analysis Logs

General

Target

17c5ff6458dda433431390ed6fde5919db0fb10dd6f201692541f6c90e5f21b5.dll
Size

304KB
MD5

3df64b48953d606b3b93a72bafc8b282
SHA1

4daeec6ef250790b6c69acaa5bf01ca3a0953585
SHA256

17c5ff6458dda433431390ed6fde5919db0fb10dd6f201692541f6c90e5f21b5
SHA512

107160dd1f08534afd889fd5870e38153c1c2bb909aebd1493b519c7db4257ebdf3e5f1609deb8739d8906f0d7a350c100a1ed756f0dd3ebfcd107f2edd931af

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

500 2868 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 500 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17c5ff6458dda433431390ed6fde5919db0fb10dd6f201692541f6c90e5f21b5.dll,#1
1⤵
PID:2868

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2868 -s 220
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-0-0x000001C518C70000-0x000001C518C71000-memory.dmp

Filesize
4KB

Download
memory/500-1-0x000001C5194E0000-0x000001C5194E1000-memory.dmp

Filesize
4KB

Download
memory/500-2-0x000001C5194E0000-0x000001C5194E1000-memory.dmp

Filesize
4KB

Download