17a3a8aa8bc54b01ff8178f332f640ced2ee10a9b74f4280895cf6b254efa442 | Triage

Analysis

max time kernel
79s
max time network
81s
platform
windows7_x64
resource
win7v20201028
submitted
17-11-2020 12:11

Sharing

Report Analysis Logs

General

Target

0883c6dc79beb55cf2cefd69d5b26a95.dll
Size

304KB
MD5

2fb6201072ae0da072b9198ab66328fd
SHA1

51e7170e889776919829f257bef8c9a39e3c6f09
SHA256

17a3a8aa8bc54b01ff8178f332f640ced2ee10a9b74f4280895cf6b254efa442
SHA512

daa01cc478e4a1a0ece46b08c4cef76592a9ccf595ca4ffe138e6501153f6adc14111d4993bdb585061ffcbbb6e5a14710129bda819292c87c015f9980588327

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1984 1128 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1984 WerFault.exe
1984 WerFault.exe
1984 WerFault.exe
1984 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1984 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1128 wrote to memory of 1984	1128	rundll32.exe	WerFault.exe
PID 1128 wrote to memory of 1984	1128	rundll32.exe	WerFault.exe
PID 1128 wrote to memory of 1984	1128	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0883c6dc79beb55cf2cefd69d5b26a95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1128 -s 56
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x0000000000000000-mapping.dmp

Download
memory/1984-1-0x0000000001E50000-0x0000000001E61000-memory.dmp

Filesize
68KB

Download
memory/1984-2-0x0000000002780000-0x0000000002791000-memory.dmp

Filesize
68KB

Download