Analysis
- max time kernel
2s - max time network
8s - platform
windows7_x64 - resource
win7v20201028 - submitted
18/11/2020, 06:12
General
- Target WOHSFR01BZAC6VP3YOYSGIHL92J4B0XM50RJR34.dll
- Size 11.0MB
- Sample201118-qrtc8bbfea
- SHA256 686e60d6079a08eaafcdca5ab248cbc18cae7c6871b989c3bcbcb9a02fd5fad9
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WOHSFR01BZAC6VP3YOYSGIHL92J4B0XM50RJR34.dll,#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1068 -s 2322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1164-1-0x0000000001D40000-0x0000000001D51000-memory.dmp
memory/1164-2-0x0000000002BA0000-0x0000000002BB1000-memory.dmp