fdc07abb9ecc883d2192c277033283b8959431dc45d07e8408eab7a18ccbe7d7 | Triage

Analysis

max time kernel
16s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
23-07-2021 14:28

Sharing

Report Analysis Logs

General

Target

dump1.bin.dll
Size

208KB
MD5

3ad7d55b243332a86c4400520c1ab04e
SHA1

e23d29aa7a9462a9a65f8fc769d9446590d0eae0
SHA256

fdc07abb9ecc883d2192c277033283b8959431dc45d07e8408eab7a18ccbe7d7
SHA512

4d4dab377b0ca988d3c5da17bd15108b25617696ec76c0770a2eea15c969d62534c34051b0f55f483e6cf1adcbd786c508f14c4f3301fa366f23bd4ec2c7068d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3784 1648 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3784 WerFault.exe
Token: SeBackupPrivilege 3784 WerFault.exe
Token: SeDebugPrivilege 3784 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 528 wrote to memory of 1648	528	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 1648	528	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 1648	528	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dump1.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dump1.bin.dll,#1
2⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 592
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-114-0x0000000000000000-mapping.dmp

Download