004f4194ca0be17f61929faacf8c75f8b8185cf7f12a00ba31e40260def480ab | Triage

Analysis

max time kernel
15s
max time network
116s
platform
windows10_x64
resource
win10v20210410
submitted
27-07-2021 18:22

Sharing

Report Analysis Logs

General

Target

nady10.dll
Size

401KB
MD5

6be94fe3a49b0d39355edbdf313695a7
SHA1

3826a06f626360bf2fea6d6fda9be51c69289fa1
SHA256

004f4194ca0be17f61929faacf8c75f8b8185cf7f12a00ba31e40260def480ab
SHA512

1edb3a457193435308031ce9941bb4d04625e819e580b1a7473b3083f736ebec993b73337656aeeefbc81e7e35e676191ab3bf9d57fc923b65a66c3e4bfabd31

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1124 588 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe
1124	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1124 WerFault.exe
Token: SeBackupPrivilege 1124 WerFault.exe
Token: SeDebugPrivilege 1124 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3744 wrote to memory of 588	3744	regsvr32.exe	regsvr32.exe
PID 3744 wrote to memory of 588	3744	regsvr32.exe	regsvr32.exe
PID 3744 wrote to memory of 588	3744	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\nady10.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3744

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\nady10.dll
2⤵
PID:588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 624
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-114-0x0000000000000000-mapping.dmp

Download
memory/588-115-0x0000000000C10000-0x0000000000D5A000-memory.dmp

Filesize
1.3MB

Download