8eada491e7fbd8285407897b678b1a3d480c416244db821cfaca0f27ab27901a | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows10_x64
resource
win10v20201028
submitted
22-03-2021 18:31

Sharing

Report Analysis Logs

General

Target

ce.exe.dll
Size

28KB
MD5

fa9e686b811a1d921623947b8fd56337
SHA1

6fd0a05f1273f1a5cb79872c452266b5788fc0f3
SHA256

8eada491e7fbd8285407897b678b1a3d480c416244db821cfaca0f27ab27901a
SHA512

44779a2364a9dbcaba5393fa0b4b2fa29f9b4ac7228f04a11344887e965bad29250e32cacb91db9d876563fe1e1047d98bac322a329563d883e15b9be5a7a85e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2420 3608 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2420 WerFault.exe
Token: SeBackupPrivilege 2420 WerFault.exe
Token: SeDebugPrivilege 2420 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 732 wrote to memory of 3608	732	rundll32.exe	rundll32.exe
PID 732 wrote to memory of 3608	732	rundll32.exe	rundll32.exe
PID 732 wrote to memory of 3608	732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce.exe.dll,#1
2⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 668
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-3-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/3608-2-0x0000000000000000-mapping.dmp

Download