2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95 | Triage

Analysis

max time kernel
103s
max time network
110s
platform
windows10_x64
resource
win10v20210408
submitted
05-05-2021 20:27

Sharing

Report Analysis Logs

General

Target

2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95.dll
Size

35KB
MD5

1bdf780ea6ff3abee41fe9f48d355592
SHA1

90177c060567990e289f746cd126975b9102d675
SHA256

2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95
SHA512

406a818310360996f8939c2f5e4728431cd077082b14e20e20b7257c235eb4d05f5a46e652f6ee00876a121050c94c4c983a992324ac68c2973abdcf514711fe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	764	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3836	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95.dll,#1
1⤵
PID:764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 764 -s 468
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads