cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f | Triage

Analysis

max time kernel
12s
max time network
139s
platform
windows10_x64
resource
win10v20210408
submitted
27-06-2021 01:22

Sharing

Report Analysis Logs

General

Target

Turtlee.games/VCRUNTIME140.dll
Size

91KB
MD5

7942be5474a095f673582997ae3054f1
SHA1

e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA256

8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA512

49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3556 3128 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3556 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Turtlee.games\VCRUNTIME140.dll,#1
1⤵
PID:3128

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3128 -s 276
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...