b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07 | Triage

Analysis

max time kernel
150s
max time network
92s
platform
windows7_x64
resource
win7v20201028
submitted
29-01-2021 16:30

Sharing

Report Analysis Logs

General

Target

libintl3.dll
Size

518KB
MD5

bd842c41b4c1b3c2deb475d7a3876599
SHA1

f7e61eb028b399b74c73883a2fccedbe56ecea2e
SHA256

b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07
SHA512

110a10662342b0d5716c3307c51fa8a591bf621049d8d291aa44f8ab864ab075064651750334619292e9362136e328c14dd637033c244d42551ac5b321941aad

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	744	WerFault.exe	13

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1636	744	rundll32.exe	22
PID 744 wrote to memory of 1636	744	rundll32.exe	22
PID 744 wrote to memory of 1636	744	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libintl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 744 -s 92
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-3-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

Filesize
8KB

Download
memory/1636-4-0x0000000001DD0000-0x0000000001DE1000-memory.dmp

Filesize
68KB

Download
memory/1636-5-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download