a93b39035f5ae1ace569c25759239f8c0361bf2462cb22f2a780c14de2821fe4 | Triage

Analysis

max time kernel
96s
max time network
136s
platform
windows10_x64
resource
win10v20210408
submitted
04-10-2021 07:48

Sharing

Report Analysis Logs

General

Target

6e2732d297f1666f6c9eed9de730c39e.exe
Size

893KB
MD5

6e2732d297f1666f6c9eed9de730c39e
SHA1

54df8b2dc7352b75dd09103f2a399fde314e4e53
SHA256

a93b39035f5ae1ace569c25759239f8c0361bf2462cb22f2a780c14de2821fe4
SHA512

0ea8f7a145129ba54132b4833952b66783ade6d28cf9f551800018de6b946e661f7c903405e22136acd037335f43ae8668fd27a3419985f3f932e50b8e6d86d8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1596 1184 WerFault.exe DpiScaling.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1596 WerFault.exe
Token: SeBackupPrivilege 1596 WerFault.exe
Token: SeDebugPrivilege 1596 WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

6e2732d297f1666f6c9eed9de730c39e.exe

description	pid	process	target process
PID 808 wrote to memory of 1184	808	6e2732d297f1666f6c9eed9de730c39e.exe	DpiScaling.exe
PID 808 wrote to memory of 1184	808	6e2732d297f1666f6c9eed9de730c39e.exe	DpiScaling.exe
PID 808 wrote to memory of 1184	808	6e2732d297f1666f6c9eed9de730c39e.exe	DpiScaling.exe
PID 808 wrote to memory of 1184	808	6e2732d297f1666f6c9eed9de730c39e.exe	DpiScaling.exe
PID 808 wrote to memory of 1184	808	6e2732d297f1666f6c9eed9de730c39e.exe	DpiScaling.exe

C:\Users\Admin\AppData\Local\Temp\6e2732d297f1666f6c9eed9de730c39e.exe
"C:\Users\Admin\AppData\Local\Temp\6e2732d297f1666f6c9eed9de730c39e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\DpiScaling.exe
C:\Windows\System32\DpiScaling.exe
2⤵
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 488
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-114-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1184-116-0x0000000000000000-mapping.dmp

Download
memory/1184-117-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download