b440c83d2c005fc947f8ad19cc0ffc7d4b780ecdd9b3a6bd82a82a8b07bc3a36 | Triage

Analysis

max time kernel
3s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
15-11-2020 22:46

Sharing

Report Analysis Logs

General

Target

b440c83d2c005fc947f8ad19cc0ffc7d4b780ecdd9b3a6bd82a82a8b07bc3a36.dll
Size

244KB
MD5

ba1029f1c462b8b8d891dab76b4f35ac
SHA1

cf3434de6ae6de2f9c9ee9153b0f577668494d51
SHA256

b440c83d2c005fc947f8ad19cc0ffc7d4b780ecdd9b3a6bd82a82a8b07bc3a36
SHA512

690ca93f90abe24f259f84e35be61a920ca2f2c059cfde77d73c76c4a6ad1f84db4a8bf6b6c03e6fcab562dbe9a83d236d9c023a72a8c6522a50fdacbc16a590

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2000 1920 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2000 WerFault.exe
2000 WerFault.exe
2000 WerFault.exe
2000 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2000 WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1756 wrote to memory of 1920	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1920	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1920	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1920	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1920	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1920	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1920	1756	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 2000	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 2000	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 2000	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 2000	1920	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b440c83d2c005fc947f8ad19cc0ffc7d4b780ecdd9b3a6bd82a82a8b07bc3a36.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b440c83d2c005fc947f8ad19cc0ffc7d4b780ecdd9b3a6bd82a82a8b07bc3a36.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 196
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-0-0x0000000000000000-mapping.dmp

Download
memory/1920-3-0x0000000000000000-mapping.dmp

Download
memory/2000-1-0x0000000000000000-mapping.dmp

Download
memory/2000-2-0x0000000001FA0000-0x0000000001FB1000-memory.dmp

Filesize
68KB

Download
memory/2000-4-0x00000000025D0000-0x00000000025E1000-memory.dmp

Filesize
68KB

Download