0104cff93a4ca0673860db9773693712c3f595f567b7b4b560da62697fb7a00c | Triage

Analysis

max time kernel
12s
max time network
105s
platform
windows10_x64
resource
win10v20201028
submitted
17-11-2020 12:02

Sharing

Report Analysis Logs

General

Target

859133cc234225f8038f97e01f30c87f.dll
Size

256KB
MD5

7586a84ad41fefdefd7e228204836192
SHA1

5f45c38b21ff07d510c6173f138aa90a15826199
SHA256

0104cff93a4ca0673860db9773693712c3f595f567b7b4b560da62697fb7a00c
SHA512

91fc032d437e207e590a9ab0b25a7ace67b9686a65388188a9dbb1783a93136089ded435520077c972f64e493a5decf74b1f835278c0ce42ffe973f6977f947e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2924 1192 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2924 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\859133cc234225f8038f97e01f30c87f.dll,#1
1⤵
PID:1192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1192 -s 292
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2924-0-0x00000202CAAD0000-0x00000202CAAD1000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x00000202CB740000-0x00000202CB741000-memory.dmp

Filesize
4KB

Download
memory/2924-2-0x00000202CB740000-0x00000202CB741000-memory.dmp

Filesize
4KB

Download