0708ca0919859901ece5681e3657db75a07e2fc9d1e03fec06ed24629aa05e6c | Triage

Analysis

max time kernel
3s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
15-11-2020 22:40

Sharing

Report Analysis Logs

General

Target

0708ca0919859901ece5681e3657db75a07e2fc9d1e03fec06ed24629aa05e6c.dll
Size

244KB
MD5

a0c17e40e2e5ea2e61174eb67469ef72
SHA1

bf0d30eb7ff2e4088bcf9a2dfb01964f05865883
SHA256

0708ca0919859901ece5681e3657db75a07e2fc9d1e03fec06ed24629aa05e6c
SHA512

c98549e4f4bc5c8e09624e464d9fa173791a0f87699f3bc0e19716304f776eb2b155464ff9f71f7fe610828988fd510dc71df3bd98fd9a4c707a87b4d77a0d26

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1944 1872 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1944 WerFault.exe
1944 WerFault.exe
1944 WerFault.exe
1944 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1944 WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1004 wrote to memory of 1872	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1872	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1872	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1872	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1872	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1872	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1872	1004	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 1944	1872	rundll32.exe	WerFault.exe
PID 1872 wrote to memory of 1944	1872	rundll32.exe	WerFault.exe
PID 1872 wrote to memory of 1944	1872	rundll32.exe	WerFault.exe
PID 1872 wrote to memory of 1944	1872	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0708ca0919859901ece5681e3657db75a07e2fc9d1e03fec06ed24629aa05e6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0708ca0919859901ece5681e3657db75a07e2fc9d1e03fec06ed24629aa05e6c.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 196
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-0-0x0000000000000000-mapping.dmp

Download
memory/1872-3-0x0000000000000000-mapping.dmp

Download
memory/1944-1-0x0000000000000000-mapping.dmp

Download
memory/1944-2-0x0000000002180000-0x0000000002191000-memory.dmp

Filesize
68KB

Download
memory/1944-4-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download