1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be | Triage

Resubmissions

12-01-2021 12:27

210112-d1k5vnv34j 9

11-01-2021 13:45

210111-x57bch18qn 9

Analysis

max time kernel
18s
max time network
117s
platform
windows10_x64
resource
win10v20201028
submitted
12-01-2021 12:27

Sharing

Report Analysis Logs

General

Target

1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be.dll
Size

2.2MB
MD5

3002d8cd12f80f4a60adeb86f7a87c8a
SHA1

4bdf7f7c8cbe9eef4e6ccd8545098da59ffc1899
SHA256

1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be
SHA512

1958cacf99641e5345e2a65dff7279f15bcce234239dfd1f9146647b367274607aa018aba31c90ad61ca31e66a819f1200ee482c7e49d203ba13e7327360bbdd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

560 4836 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 560 WerFault.exe
Token: SeBackupPrivilege 560 WerFault.exe
Token: SeDebugPrivilege 560 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4772 wrote to memory of 4836	4772	rundll32.exe	rundll32.exe
PID 4772 wrote to memory of 4836	4772	rundll32.exe	rundll32.exe
PID 4772 wrote to memory of 4836	4772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be.dll,#1
2⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 624
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-6-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/4836-2-0x0000000000000000-mapping.dmp

Download
memory/4836-7-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download