0724c341900f1b1e879ac2d36f687a90fa641688864e39ec10e017d2d92c318b | Triage

Analysis

max time kernel
258s
max time network
258s
platform
windows10_x64
resource
win10v20201028
submitted
23-02-2021 13:01

Sharing

Report Analysis Logs

General

Target

suckwarebest.dll
Size

388KB
MD5

1989c701fdcc4e23e21ab602e626fe12
SHA1

7aa4f4a4a767daaf3ed68abda40bf084c657448e
SHA256

f178acc27232ab83cbda84beb29f948f0e1c6b4c8b1ece8645613875c3298cbb
SHA512

908f0091d3e208bd4c634c56e5ceb38840403f4749023efbb50a0143bcabd041db8487e5cb6eaf05980541303472b8bce84acbabe6c22e1ef74f64d3564e8611

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3028 636 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3028 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\suckwarebest.dll,#1
1⤵
PID:636

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 636 -s 508
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-2-0x0000024BDD890000-0x0000024BDD891000-memory.dmp

Filesize
4KB

Download