82f5ee1bdfa56249538cc73017655a380a0eadb6b812fd7e6fd05bc43d647fad | Triage

Analysis

max time kernel
125s
max time network
133s
platform
windows7_x64
resource
win7v20201028
submitted
17-11-2020 11:21

Sharing

Report Analysis Logs

General

Target

488e8b7aa492b544a17dca68991cea92.dll
Size

256KB
MD5

ef0b3dcbf6a9237a12e3f93edff4f84c
SHA1

7890e5939709fd1b4fc11933ec612187ba6de445
SHA256

82f5ee1bdfa56249538cc73017655a380a0eadb6b812fd7e6fd05bc43d647fad
SHA512

c2e30677655049da35e84406446d24d5d03ee59f91bcb6da299cb0a8a087625e9ec0c360659bb8311997bc617b9da21afd3c1c15be0adf335bac0ce62980a9b7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2012 1632 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2012 WerFault.exe
2012 WerFault.exe
2012 WerFault.exe
2012 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2012 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1632 wrote to memory of 2012	1632	rundll32.exe	WerFault.exe
PID 1632 wrote to memory of 2012	1632	rundll32.exe	WerFault.exe
PID 1632 wrote to memory of 2012	1632	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\488e8b7aa492b544a17dca68991cea92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1632 -s 108
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000000000-mapping.dmp

Download
memory/2012-1-0x0000000001E80000-0x0000000001E91000-memory.dmp

Filesize
68KB

Download
memory/2012-2-0x0000000002810000-0x0000000002821000-memory.dmp

Filesize
68KB

Download