8368a955dd5d9850ed8ced6144a202368c52e065abafdb71a7960d3a90647e85 | Triage

Analysis

max time kernel
14s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
29-06-2021 02:19

Sharing

Report Analysis Logs

General

Target

dCurTable.jpg.dll
Size

3.0MB
MD5

6daccc54cd517e02c320ff14461ae729
SHA1

d6997e1f95b31701a75a2082528f23ec34b47003
SHA256

8368a955dd5d9850ed8ced6144a202368c52e065abafdb71a7960d3a90647e85
SHA512

f6940556982687110d64ecc6acfa20e89d929a896d4b7e2b974011db02b9a3aa18f6145425cace9690d7d859ee4f2b7f808ea8518a84d76a2050c7218ea28594

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3024 3164 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3024 WerFault.exe
Token: SeBackupPrivilege 3024 WerFault.exe
Token: SeDebugPrivilege 3024 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 804 wrote to memory of 3164	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 3164	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 3164	804	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dCurTable.jpg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\dCurTable.jpg.dll
2⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 628
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-114-0x0000000000000000-mapping.dmp

Download
memory/3164-115-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/3164-116-0x00000000009E0000-0x0000000000A23000-memory.dmp

Filesize
268KB

Download