Analysis
- max time kernel
12s - max time network
113s - platform
windows10_x64 - resource
win10v20201028 - submitted
18/11/2020, 06:12
General
- Target WOHSFR01BZAC6VP3YOYSGIHL92J4B0XM50RJR34.dll
- Size 11.0MB
- Sample201118-qrtc8bbfea
- SHA256 686e60d6079a08eaafcdca5ab248cbc18cae7c6871b989c3bcbcb9a02fd5fad9
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WOHSFR01BZAC6VP3YOYSGIHL92J4B0XM50RJR34.dll,#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 580 -s 5362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4016-0-0x0000026F469B0000-0x0000026F469B1000-memory.dmp
memory/4016-1-0x0000026F47720000-0x0000026F47721000-memory.dmp
memory/4016-2-0x0000026F47720000-0x0000026F47721000-memory.dmp