cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f | Triage

Analysis

max time kernel
16s
max time network
114s
platform
windows10_x64
resource
win10v20210408
submitted
27-06-2021 01:22

Sharing

Report Analysis Logs

General

Target

Turtlee.games/_queue.pyd.dll
Size

28KB
MD5

671a9ac9b34f07ada65bf1635e4626c5
SHA1

d4a6e478caaacdbdb52f57d12e16ba96671d30f2
SHA256

3f1fc09b3f0a5c8c7aff4223d002952ab26f462aa390940a9f00454815204739
SHA512

92617258ef747f93ab2c378f5c9a2aac14668d834df15939c1ef83a555490b9ee3380d7341bee60c33057482736a595593749b8794ddeaa9649339363095108c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1460 4000 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1460 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Turtlee.games\_queue.pyd.dll,#1
1⤵
PID:4000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4000 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...