09f524453a6846e6e2d6aaa874dd60f6aa0f73de45b83192bca7c09631bbe5cc | Triage

Analysis

max time kernel
11s
max time network
118s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 06:35

Sharing

Report Analysis Logs

General

Target

d37fcaa31e9c9103b7086ed2611ce358.dll
Size

236KB
MD5

d37fcaa31e9c9103b7086ed2611ce358
SHA1

41a86d3d945b24df33b96aba20354b1ab4c97eef
SHA256

09f524453a6846e6e2d6aaa874dd60f6aa0f73de45b83192bca7c09631bbe5cc
SHA512

660849efb03a4202233516ed21f471ad83ceb0d5a5dad4a8aaeaba41b5e0dbe23142bbe00687e007b4c67ac24ed6d3351933fdd1d37f71e649e97432ad48d3e2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3524 4792 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3524 WerFault.exe
Token: SeBackupPrivilege 3524 WerFault.exe
Token: SeDebugPrivilege 3524 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4768 wrote to memory of 4792	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4792	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4792	4768	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d37fcaa31e9c9103b7086ed2611ce358.dll,#1
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 600
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d37fcaa31e9c9103b7086ed2611ce358.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3524-3-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/4792-2-0x0000000000000000-mapping.dmp

Download