9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2 | Triage

Resubmissions

01-11-2021 12:31

211101-pp5r3ahha4 10

31-10-2021 09:03

211031-k1bwxacfaq 10

14-10-2021 01:44

211014-b6aflafeg4 10

Analysis

max time kernel
110s
max time network
3735s
platform
windows10_x64
resource
win10-en-20211014
submitted
31-10-2021 09:03

Sharing

Report Analysis Logs

General

Target

24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll
Size

488KB
MD5

8c778eded8caf98e71730b164b805e1b
SHA1

8f2180d092ac3b623d2372cb01eaccde0f5e402c
SHA256

24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365
SHA512

666aa5d99be4efa4a3a9c9021a116d8484e05120224c463b66246bf99f0d925a37b54c8e6902b7c7d8c7929c6748cc2ca45801525346de5bcef205a6fac33b18

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1052 3576 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1052 WerFault.exe
Token: SeBackupPrivilege 1052 WerFault.exe
Token: SeDebugPrivilege 1052 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2068 wrote to memory of 3576	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 3576	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 3576	2068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll,#1
2⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 580
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3576-118-0x0000000000000000-mapping.dmp

Download