cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f | Triage

Analysis

max time kernel
13s
max time network
153s
platform
windows10_x64
resource
win10v20210410
submitted
27-06-2021 01:22

Sharing

Report Analysis Logs

General

Target

Turtlee.games/_lzma.pyd.dll
Size

159KB
MD5

caa58290ab4414e2e22cc0b6ff4b2d29
SHA1

840902aaf7db40da17018776e5c842014c3a81ac
SHA256

185d407bcca7399c458133f2ce1efa938352b8093b2de040c91c3c3088ab173f
SHA512

a82e380ab1676424e52a36c08eabd572375dd36a7fe2b9df51d48c368aed6c04b0b3674bc6a9787efedd0ed70bb1869ed1a2f3a1f4238485710092b9cbadd00e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1364 2116 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1364 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Turtlee.games\_lzma.pyd.dll,#1
1⤵
PID:2116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2116 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...