cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f | Triage

Analysis

max time kernel
11s
max time network
114s
platform
windows10_x64
resource
win10v20210410
submitted
27-06-2021 01:22

Sharing

Report Analysis Logs

General

Target

Turtlee.games/_ctypes.pyd.dll
Size

124KB
MD5

e1ef9f5c77b01c82cf72522ec96b2a11
SHA1

e83daa56a104f6ea6235822c644b6554c3958cfe
SHA256

a79cf8259890d5843cf8eaf29db8dbd4bfabed50f4d859756f93ac2b30617023
SHA512

4231ec5b06effae6497bf62853b79420529cabaee6b58f519c3c30bdd42c925e85979c29c2db0747dcff3f99f3b19dc02ece96347e08cf49eb0abb1e19238c01

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1060 2232 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1060 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Turtlee.games\_ctypes.pyd.dll,#1
1⤵
PID:2232

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2232 -s 304
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1060

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...