cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f | Triage

Analysis

max time kernel
12s
max time network
128s
platform
windows10_x64
resource
win10v20210408
submitted
27-06-2021 01:22

Sharing

Report Analysis Logs

General

Target

Turtlee.games/_multiprocessing.pyd.dll
Size

29KB
MD5

bc608ce15ef2a69c79ff9ffd5f5f074a
SHA1

3034bf16a074bfc35764749165c7a7853ba595b9
SHA256

25857b22fbb275fc2524dfc468731912f93bb52a744fd20410eb29ec6986fc8e
SHA512

397049a1c223b093a96d0490e1ce2e542f85cc878c1753454671b782873c61653162f5be4689072647cc7d9779baefa91e315049982924cd6f1799d77b8dffa5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3148 3492 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3148 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Turtlee.games\_multiprocessing.pyd.dll,#1
1⤵
PID:3492

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3492 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...