3704515bfde5dd13bd6a97535f325f30b567133e47ec6ae5ad00c5f1402cc41a | Triage

Analysis

max time kernel
17s
max time network
136s
platform
windows10_x64
resource
win10v20210408
submitted
15-07-2021 16:47

Sharing

Report Analysis Logs

General

Target

423052e.dll
Size

206KB
MD5

5709c471dbb09e67e6ba02a71094c754
SHA1

e40a9c771de7417042fd4ea33887438c5526f141
SHA256

3704515bfde5dd13bd6a97535f325f30b567133e47ec6ae5ad00c5f1402cc41a
SHA512

eeed5e0c7fd064c639f07969fcefe3fea34fc36cacbba0a5f58c36c7e3a6ef2adc465d8ced58d3e2d49f83999299f2da755f291d75cb11af9b49c7e221849053

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2760 2244 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2760 WerFault.exe
Token: SeBackupPrivilege 2760 WerFault.exe
Token: SeDebugPrivilege 2760 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3128 wrote to memory of 2244	3128	regsvr32.exe	regsvr32.exe
PID 3128 wrote to memory of 2244	3128	regsvr32.exe	regsvr32.exe
PID 3128 wrote to memory of 2244	3128	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\423052e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\423052e.dll
2⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 608
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2244-114-0x0000000000000000-mapping.dmp

Download
memory/2244-115-0x00000000008F0000-0x0000000000A3A000-memory.dmp

Filesize
1.3MB

Download