23c14b2be92b47ce6766c9299744cbbc09f76c5a39924b84749c73d255e51436 | Triage

Analysis

max time kernel
14s
max time network
124s
platform
windows10_x64
resource
win10v20210410
submitted
29-06-2021 17:04

Sharing

Report Analysis Logs

General

Target

argCaption.jpg.dll
Size

647KB
MD5

02239f6d72293cdc4ff6c91ee065ad78
SHA1

7c9d66281330d20a73ced4cd0dea55a48983112b
SHA256

23c14b2be92b47ce6766c9299744cbbc09f76c5a39924b84749c73d255e51436
SHA512

20dcc798723b46f0b391cb011a6d751d0900962ead984a7cb3ccb9903e4fd208827f36c16a01ff293776ee5c3ec77c461edbb970dd66bd77cff2cb8d6a5171ab

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2332 4664 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2332 WerFault.exe
Token: SeBackupPrivilege 2332 WerFault.exe
Token: SeDebugPrivilege 2332 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4428 wrote to memory of 4664	4428	regsvr32.exe	regsvr32.exe
PID 4428 wrote to memory of 4664	4428	regsvr32.exe	regsvr32.exe
PID 4428 wrote to memory of 4664	4428	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\argCaption.jpg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\argCaption.jpg.dll
2⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 616
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4664-114-0x0000000000000000-mapping.dmp

Download
memory/4664-115-0x0000000000EF0000-0x0000000000F27000-memory.dmp

Filesize
220KB

Download
memory/4664-116-0x0000000000F30000-0x0000000000F73000-memory.dmp

Filesize
268KB

Download