08934079f330381b5a9bd3f4f089f328b77c26080aff49a3894b6e4de0d485bc | Triage

Analysis

max time kernel
5s
max time network
14s
platform
windows7_x64
resource
win7v20201028
submitted
20-11-2020 07:39

Sharing

Report Analysis Logs

General

Target

54e09973da1818e1c74c58afb44309a1.dll
Size

199KB
MD5

54e09973da1818e1c74c58afb44309a1
SHA1

f6179da0ca78312643dd68675f13fd496630656c
SHA256

08934079f330381b5a9bd3f4f089f328b77c26080aff49a3894b6e4de0d485bc
SHA512

fb6fa0a8efa499e0adc7728ea8d8f733d41b080764979b7c548bcdfa676ceff0bdd09f33c44477e3acd9469798a3319422481cc422c884fda4ad9c470f9b2cce

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1504 368 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1504 WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 292 wrote to memory of 368	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 368	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 368	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 368	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 368	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 368	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 368	292	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1504	368	rundll32.exe	WerFault.exe
PID 368 wrote to memory of 1504	368	rundll32.exe	WerFault.exe
PID 368 wrote to memory of 1504	368	rundll32.exe	WerFault.exe
PID 368 wrote to memory of 1504	368	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54e09973da1818e1c74c58afb44309a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54e09973da1818e1c74c58afb44309a1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 244
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-0-0x0000000000000000-mapping.dmp

Download
memory/368-3-0x0000000000000000-mapping.dmp

Download
memory/1504-1-0x0000000000000000-mapping.dmp

Download
memory/1504-2-0x0000000002070000-0x0000000002081000-memory.dmp

Filesize
68KB

Download
memory/1504-4-0x00000000027D0000-0x00000000027E1000-memory.dmp

Filesize
68KB

Download