d45f541b13139346d518b1ab79a5f70dda19ab6359327d7b76ab91a459813754 | Triage

Analysis

max time kernel
372s
max time network
401s
platform
windows10_x64
resource
win10v20210410
submitted
18-08-2021 18:23

Sharing

Report Analysis Logs

General

Target

UX Launcher.dll.exe
Size

703KB
MD5

37bb41c2a36458278f9e7e57db857eb8
SHA1

e11cd02bdbdc04a5f01dbe4225692e875ae140a4
SHA256

63abf02eb02e2e289909a4eb3f7f936a6c677694ea913d120a4502f85ef1f54e
SHA512

028e7ee50f8e091c7720246dc2a01c29617d20b31048d7fae464a2edc7179c47219ff22fa642ebdef8786d058395109ccec686a7f669525ebbdf726d9231aab9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2204 4072 WerFault.exe UX Launcher.dll.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe
2204	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2204 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\UX Launcher.dll.exe
"C:\Users\Admin\AppData\Local\Temp\UX Launcher.dll.exe"
1⤵
PID:4072

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4072 -s 676
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-114-0x000001EDA9650000-0x000001EDA9651000-memory.dmp

Filesize
4KB

Download