d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

Analysis

max time kernel
111s
max time network
53s
platform
windows7_x64
resource
win7v20210408
submitted
13-05-2021 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe
Size

426KB
MD5

eb8fcc126b19d339fc633648961a981c
SHA1

5261c6195cce1ca134e1407ce6effde1f1915597
SHA256

d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba
SHA512

d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

Processes:

WerFault.exe

pid	process
1952	WerFault.exe
1952	WerFault.exe
1952	WerFault.exe
1952	WerFault.exe
1952	WerFault.exe
1952	WerFault.exe
1952	WerFault.exe
1952	WerFault.exe
1952	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 292 WerFault.exe d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1952 WerFault.exe
1952 WerFault.exe
1952 WerFault.exe
1952 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1952 WerFault.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

pid process

292 d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1952 WerFault.exe

pid	pid_target	process	target process
1952	292	WerFault.exe	d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

pid	process
292	d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

description	pid	process
Token: SeDebugPrivilege	1952	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

description	pid	process	target process
PID 292 wrote to memory of 1952	292	d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe	WerFault.exe
PID 292 wrote to memory of 1952	292	d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe	WerFault.exe
PID 292 wrote to memory of 1952	292	d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe	WerFault.exe
PID 292 wrote to memory of 1952	292	d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe
"C:\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 132
  2⤵
  - Loads dropped DLL
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
\Users\Admin\AppData\Local\Temp\d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba.exe

MD5
eb8fcc126b19d339fc633648961a981c

SHA1
5261c6195cce1ca134e1407ce6effde1f1915597

SHA256
d1167dc9f0ef8dd16c0b5675247f369334dff56413a2dee459c5cee3fd5a25ba

SHA512
d56efea63776e3dc5d129b76161e9b9ac5ecc3c7cefb729d471b255f6d42b0e21b5dc65dd5372b9321f17ea110743e79bd42f73dc75f62d1e20ea8fe9c34e0f8

Download Submit
memory/1952-59-0x0000000000000000-mapping.dmp

Download
memory/1952-70-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download