Resubmissions

14-09-2021 02:31

210914-cz6qwsefd9 10

13-09-2021 20:10

210913-yxsxxahdcl 10

13-09-2021 20:05

210913-ytxrpahdcj 3

13-09-2021 18:29

210913-w448eaecc9 10

13-09-2021 17:14

210913-vr22vahcap 3

Analysis

  • max time kernel
    435s
  • max time network
    1002s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    13-09-2021 20:10

General

  • Target

    currCurrPl.jpg.dll

  • Size

    542KB

  • MD5

    d0cb3cab255e5300af43426963df136c

  • SHA1

    1d4c9fde145c5c42c3e4a7230b96e395fb9ac6bc

  • SHA256

    27557ee7f8721a728a65676740ccc1246f4de3bba9496b467b6ba7e8e0129fc4

  • SHA512

    72768b7ccccbafee0e051dd3f6bb766a058759523fedeaa5dc126e5a4cb9f9d3f29c25c55f2497ceb9bc4239938b0f5ae898b2cf562652d3c248ac8166dddda1

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\currCurrPl.jpg.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\currCurrPl.jpg.dll
      2⤵
        PID:3768
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 620
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3944

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3768-115-0x0000000000000000-mapping.dmp
    • memory/3768-116-0x0000000010000000-0x0000000010004000-memory.dmp
      Filesize

      16KB

    • memory/3768-119-0x00000000031E0000-0x0000000003218000-memory.dmp
      Filesize

      224KB

    • memory/3768-121-0x0000000004AF0000-0x0000000004B35000-memory.dmp
      Filesize

      276KB