cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f | Triage

Analysis

max time kernel
13s
max time network
115s
platform
windows10_x64
resource
win10v20210408
submitted
27-06-2021 01:22

Sharing

Report Analysis Logs

General

Target

Turtlee.games/_bz2.pyd.dll
Size

84KB
MD5

5a8b3602b3560868bd819b10c6343874
SHA1

73a5ce4d07479894f24b776eb387abd33deb83a9
SHA256

00d2f34aee55b473bcc11838469b94a62d01fdf4465e19f7d7388c79132f019e
SHA512

2f2f8305fd8853c479b5d2a442110efc3ad41a3c482cd554ebcc405fcf097e230f5cd45dbfb44050b5bd6fae662ce7cac0583c9784050f0c7d09a678768587db

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2592 912 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2592 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Turtlee.games\_bz2.pyd.dll,#1
1⤵
PID:912

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 912 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...