b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07 | Triage

Analysis

max time kernel
150s
max time network
91s
platform
windows7_x64
resource
win7v20201028
submitted
08-02-2021 20:47

Sharing

Report Analysis Logs

General

Target

b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07.dll
Size

518KB
MD5

bd842c41b4c1b3c2deb475d7a3876599
SHA1

f7e61eb028b399b74c73883a2fccedbe56ecea2e
SHA256

b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07
SHA512

110a10662342b0d5716c3307c51fa8a591bf621049d8d291aa44f8ab864ab075064651750334619292e9362136e328c14dd637033c244d42551ac5b321941aad

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	308	WerFault.exe	18

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1932	WerFault.exe
1932	WerFault.exe
1932	WerFault.exe
1932	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1932	308	rundll32.exe	25
PID 308 wrote to memory of 1932	308	rundll32.exe	25
PID 308 wrote to memory of 1932	308	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 308 -s 92
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-3-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp

Filesize
8KB

Download
memory/1932-4-0x0000000002010000-0x0000000002021000-memory.dmp

Filesize
68KB

Download
memory/1932-5-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download