6eeefc25fe1d24d3f46b554a31aea357a4cd04635db5c32dfddf28b5446c09d3 | Triage

Analysis

max time kernel
85s
max time network
94s
platform
windows10_x64
resource
win10v20210408
submitted
24-09-2021 10:27

Sharing

Report Analysis Logs

General

Target

6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
Size

200KB
MD5

d7bf01f9fb24176f2d42d770d79e8c2c
SHA1

9b8eeaf746cd5d903f70c3b245b9466c40b74c5d
SHA256

6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d
SHA512

0f299b9637c92098eda3a0d27a384e62d9fbaac4a2042cce84f5b1437eea1a17534331931ea5e6a68d79077cefb8678411900165b79fb4040578afaef354ee79

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3576 2220 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe
3576	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3576 WerFault.exe
Token: SeBackupPrivilege 3576 WerFault.exe
Token: SeDebugPrivilege 3576 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2228 wrote to memory of 2220	2228	regsvr32.exe	regsvr32.exe
PID 2228 wrote to memory of 2220	2228	regsvr32.exe	regsvr32.exe
PID 2228 wrote to memory of 2220	2228	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
2⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 608
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-116-0x0000000000000000-mapping.dmp

Download