b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07 | Triage

Analysis

max time kernel
12s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
08-02-2021 20:47

Sharing

Report Analysis Logs

General

Target

b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07.dll
Size

518KB
MD5

bd842c41b4c1b3c2deb475d7a3876599
SHA1

f7e61eb028b399b74c73883a2fccedbe56ecea2e
SHA256

b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07
SHA512

110a10662342b0d5716c3307c51fa8a591bf621049d8d291aa44f8ab864ab075064651750334619292e9362136e328c14dd637033c244d42551ac5b321941aad

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
800	3284	WerFault.exe	42

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b820e8a2057112d0ed73bd7995201dbed79a79e13c79d4bdad81a22f12387e07.dll,#1
1⤵
PID:3284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3284 -s 276
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-2-0x000001E046790000-0x000001E046791000-memory.dmp

Filesize
4KB

Download