91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9 | Triage

Analysis

max time kernel
14s
max time network
114s
platform
windows10_x64
resource
win10v20210410
submitted
30-07-2021 09:06

Sharing

Report Analysis Logs

General

Target

GdiPlus.dll
Size

1.6MB
MD5

a49decbfaf009c82e5e414f885f181f0
SHA1

33e718389544dcb4cb645641e4f6d8591707cda6
SHA256

085696538c772e4a09449a3046293a59b6a72fc096d777c47511285ae5e53b80
SHA512

e267ecd74de5c4259dc4fa8214bda73c9b8a1f090032a411dfd4514c3b99fef40d77faaea1716d1bdb91a16b5aca085fc603d7b708c417e3f938274416a4ed3e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2096 3916 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2096 WerFault.exe
Token: SeBackupPrivilege 2096 WerFault.exe
Token: SeDebugPrivilege 2096 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3968 wrote to memory of 3916	3968	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 3916	3968	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 3916	3968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GdiPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GdiPlus.dll,#1
2⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 632
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3916-114-0x0000000000000000-mapping.dmp

Download