9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7 | Triage

Resubmissions

04-02-2021 15:57

210204-7ddakabam6 10

25-01-2021 14:31

210125-8btrv6fz22 10

22-01-2021 07:56

210122-t6s44f1q3n 10

14-12-2020 16:08

201214-rvlc1zsl7x 10

Analysis

max time kernel
12s
max time network
104s
platform
windows10_x64
resource
win10v20201028
submitted
14-12-2020 16:08

Sharing

Report Analysis Logs

General

Target

b5b2765aaf97ae9c22abd312e684616d.dll
Size

820KB
MD5

b5b2765aaf97ae9c22abd312e684616d
SHA1

a66a652c2067f7489b83aba3b78502c0f482863b
SHA256

9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7
SHA512

af6c0a6c582a0cfd4f7de6bf1cf0199898b31edc0dba5467a499c2148e425d91d556bd7eebd08faf093d610cbf2afbee2237affc206106c7209cb2492a563279

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3104 created 1232 3104 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3104 1232 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe
3104	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3104 WerFault.exe
Token: SeBackupPrivilege 3104 WerFault.exe
Token: SeDebugPrivilege 3104 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1160 wrote to memory of 1232	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1232	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1232	1160	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5b2765aaf97ae9c22abd312e684616d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5b2765aaf97ae9c22abd312e684616d.dll,#1
2⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 580
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-2-0x0000000000000000-mapping.dmp

Download
memory/1232-4-0x0000000000000000-mapping.dmp

Download
memory/1232-5-0x0000000000000000-mapping.dmp

Download
memory/3104-3-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3104-6-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download