2a17e3086c909b6f21fc681ded7cad0f85c308118691899b181948cb4a11d81c

Analysis

max time kernel
53s
max time network
54s
platform
windows7_x64
resource
win7v20201028
submitted
25-03-2021 22:00

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Wolfteam/api_ms_win_core_timezone_l1_1_0.dll
Size

18KB
MD5

fbfd4e793c857621f39f072eda5090df
SHA1

a58fc3833c54916b1f5bdf7a795782a3fd9350d2
SHA256

a64bc428270acd0abe920239d79930dd0bff1e800adf4d746e55d86d59edac25
SHA512

851e0f35cf4f2cd4b35c106e0cd1911b26116aa96592ce9cf788355ed17f72cf5e1c0833435bf1528300b8440e049b652391c13202721cdafa4b01c47461ec3b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1148 1992 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1148 WerFault.exe
1148 WerFault.exe
1148 WerFault.exe
1148 WerFault.exe

pid	pid_target	process	target process
1148	1992	WerFault.exe	rundll32.exe

pid	process
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

WerFault.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1148	WerFault.exe
Token: 33	848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	848	AUDIODG.EXE
Token: 33	848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	848	AUDIODG.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1088 wrote to memory of 1992	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1992	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1992	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1992	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1992	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1992	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1992	1088	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1148	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 1148	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 1148	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 1148	1992	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wolfteam\api_ms_win_core_timezone_l1_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wolfteam\api_ms_win_core_timezone_l1_1_0.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 224
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:592

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-7-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp

Filesize
8KB

Download
memory/592-8-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/1000-10-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1148-4-0x0000000000000000-mapping.dmp

Download
memory/1148-5-0x0000000002010000-0x0000000002021000-memory.dmp

Filesize
68KB

Download
memory/1148-6-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1992-2-0x0000000000000000-mapping.dmp

Download
memory/1992-3-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads