Analysis
-
max time kernel
5s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-11-2020 22:37
Static task
static1
Behavioral task
behavioral1
Sample
e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa.dll
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa.dll
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa.dll
-
Size
202KB
-
MD5
c98df0fc1bae93c9a904ac4c0dde5106
-
SHA1
4c28ac10e5a9cb231a9886942bcff1647e8e3632
-
SHA256
e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa
-
SHA512
d6d84a1fcecb588eb702c79b006be2929a96085152c11a5c22e18d83e19953a4647e7d092c653c1a18c6e10ed37e7e2ef86a085f21cb04ead7d63b159f113fe8
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1912 1688 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1912 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1012 wrote to memory of 1688 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 1688 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 1688 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 1688 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 1688 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 1688 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 1688 1012 rundll32.exe rundll32.exe PID 1688 wrote to memory of 1912 1688 rundll32.exe WerFault.exe PID 1688 wrote to memory of 1912 1688 rundll32.exe WerFault.exe PID 1688 wrote to memory of 1912 1688 rundll32.exe WerFault.exe PID 1688 wrote to memory of 1912 1688 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 2443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1688-0-0x0000000000000000-mapping.dmp
-
memory/1688-3-0x0000000000000000-mapping.dmp
-
memory/1912-1-0x0000000000000000-mapping.dmp
-
memory/1912-2-0x0000000001E80000-0x0000000001E91000-memory.dmpFilesize
68KB
-
memory/1912-4-0x00000000026D0000-0x00000000026E1000-memory.dmpFilesize
68KB