17a3a8aa8bc54b01ff8178f332f640ced2ee10a9b74f4280895cf6b254efa442 | Triage

Analysis

max time kernel
11s
max time network
119s
platform
windows10_x64
resource
win10v20201028
submitted
17-11-2020 12:11

Sharing

Report Analysis Logs

General

Target

0883c6dc79beb55cf2cefd69d5b26a95.dll
Size

304KB
MD5

2fb6201072ae0da072b9198ab66328fd
SHA1

51e7170e889776919829f257bef8c9a39e3c6f09
SHA256

17a3a8aa8bc54b01ff8178f332f640ced2ee10a9b74f4280895cf6b254efa442
SHA512

daa01cc478e4a1a0ece46b08c4cef76592a9ccf595ca4ffe138e6501153f6adc14111d4993bdb585061ffcbbb6e5a14710129bda819292c87c015f9980588327

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5040 4760 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe
5040	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 5040 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0883c6dc79beb55cf2cefd69d5b26a95.dll,#1
1⤵
PID:4760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4760 -s 220
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5040-0-0x000001F085FA0000-0x000001F085FA1000-memory.dmp

Filesize
4KB

Download
memory/5040-1-0x000001F086A80000-0x000001F086A81000-memory.dmp

Filesize
4KB

Download
memory/5040-2-0x000001F086A80000-0x000001F086A81000-memory.dmp

Filesize
4KB

Download