2b1a1f2cf9b95c22e02d7a707e5f436d9d4cfcf1db8a09ec1823d52c524c0838 | Triage

Analysis

max time kernel
14s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
28-07-2021 01:13

Sharing

Report Analysis Logs

General

Target

742c0000.qScrollBar.dll
Size

117KB
MD5

e65b89698018208a7f95a9ab9b18ffa5
SHA1

8b7f008ec5c3b91f75c6cafd199a5f8dcd2d8049
SHA256

2b1a1f2cf9b95c22e02d7a707e5f436d9d4cfcf1db8a09ec1823d52c524c0838
SHA512

e198fbc78ce37b81ccdabcd20884eee59d939ff6bd0ab36df4ce36e97f60ff4bc1612a5dada8f3dd77b3377dea0fd9923b7526e308c5831c8e3ed0fb9057589d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

500 1296 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe
500	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 500 WerFault.exe
Token: SeBackupPrivilege 500 WerFault.exe
Token: SeDebugPrivilege 500 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 656 wrote to memory of 1296	656	rundll32.exe	rundll32.exe
PID 656 wrote to memory of 1296	656	rundll32.exe	rundll32.exe
PID 656 wrote to memory of 1296	656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\742c0000.qScrollBar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\742c0000.qScrollBar.dll,#1
2⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 616
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:500

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-114-0x0000000000000000-mapping.dmp

Download