9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2 | Triage

Resubmissions

01-11-2021 12:31

211101-pp5r3ahha4 10

31-10-2021 09:03

211031-k1bwxacfaq 10

14-10-2021 01:44

211014-b6aflafeg4 10

Analysis

max time kernel
123s
max time network
3736s
platform
windows10_x64
resource
win10-en-20211014
submitted
31-10-2021 09:03

Sharing

Report Analysis Logs

General

Target

67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
Size

1.4MB
MD5

c00e0c5f7cf5ca5a1ecaf2f52cb0fe3f
SHA1

943f28aaad96f667c5afc9480f14f06701b6faf1
SHA256

67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce
SHA512

685b3472e5a9f11fa21bc21b4c213256aaa23ed12db109ceb410f018df4e24114628ae9c6088d43e438d8f756f18dcad83797ee39562eb17c0131f1aa4133078

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1216 3596 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe
1216	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1216 WerFault.exe
Token: SeBackupPrivilege 1216 WerFault.exe
Token: SeDebugPrivilege 1216 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2804 wrote to memory of 3596	2804	regsvr32.exe	regsvr32.exe
PID 2804 wrote to memory of 3596	2804	regsvr32.exe	regsvr32.exe
PID 2804 wrote to memory of 3596	2804	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
2⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 608
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-118-0x0000000000000000-mapping.dmp

Download