cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f | Triage

Analysis

max time kernel
10s
max time network
125s
platform
windows10_x64
resource
win10v20210410
submitted
27-06-2021 01:22

Sharing

Report Analysis Logs

General

Target

Turtlee.games/_hashlib.pyd.dll
Size

64KB
MD5

8f7edaff246c46dbf09ab5554b918b37
SHA1

c14c33b14419f5d24fb36e5f1bf1760a9c63228b
SHA256

9154b36c178d84a901edad689a53148451ef3c851a91447a0654f528a620d944
SHA512

1947a1010fa1b07671aa471d5821792dee7f2b0cd1937d3f944cd0201a299e6cb37a41debbbd1bc6e774186f6d08ad6264055cba7652b0d5bd22691431cb360e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1424 3992 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1424 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Turtlee.games\_hashlib.pyd.dll,#1
1⤵
PID:3992

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3992 -s 320
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...