34614187ce317f6d035d659e9d0d1c103942dc668262e590a0ee695840a1d1ff | Triage

Analysis

max time kernel
17s
max time network
113s
platform
windows10_x64
resource
win10v20210408
submitted
28-07-2021 01:35

Sharing

Report Analysis Logs

General

Target

74510000.qInconsistentFormula.dll
Size

117KB
MD5

d6eb22ed48708bbacbbf1a479024c4e8
SHA1

bd63c1735c2382a342320adde50f39f38a94dca7
SHA256

34614187ce317f6d035d659e9d0d1c103942dc668262e590a0ee695840a1d1ff
SHA512

1fc421a03c07be168dc0e0d6519775a4363898dfcfc1debb793db20647dd8bea13dda4bfc270568140ad78a736cfbf3fb0d886d9f9f95fa4615a9947ea3afd30

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3920 3564 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe
3920	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3920 WerFault.exe
Token: SeBackupPrivilege 3920 WerFault.exe
Token: SeDebugPrivilege 3920 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3628 wrote to memory of 3564	3628	rundll32.exe	rundll32.exe
PID 3628 wrote to memory of 3564	3628	rundll32.exe	rundll32.exe
PID 3628 wrote to memory of 3564	3628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74510000.qInconsistentFormula.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74510000.qInconsistentFormula.dll,#1
2⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 616
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3564-114-0x0000000000000000-mapping.dmp

Download