Analysis
-
max time kernel
110s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
02-11-2021 17:13
Static task
static1
Behavioral task
behavioral1
Sample
9ab72281000874e379981e17a28bcf530b2293ab99a75ce6c9e778d28ad88707.dll
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
9ab72281000874e379981e17a28bcf530b2293ab99a75ce6c9e778d28ad88707.dll
Resource
win10-en-20211014
General
-
Target
9ab72281000874e379981e17a28bcf530b2293ab99a75ce6c9e778d28ad88707.dll
-
Size
164KB
-
MD5
37a51a1ef8ed72280614ced5631b0615
-
SHA1
16342a36e143cef94dc125d0d96a75485b479708
-
SHA256
9ab72281000874e379981e17a28bcf530b2293ab99a75ce6c9e778d28ad88707
-
SHA512
069dbf2b6b503157ef1e0c2fa061ebb682b9edaddf4f9258d908ed13d72c05e98127e40da14dfd369e98105d0882c8e400bd5e42b6ea53a3177bb8022d0c070e
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3304 created 864 3304 WerFault.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3304 864 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe 3304 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3304 WerFault.exe Token: SeBackupPrivilege 3304 WerFault.exe Token: SeDebugPrivilege 3304 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 652 wrote to memory of 864 652 rundll32.exe rundll32.exe PID 652 wrote to memory of 864 652 rundll32.exe rundll32.exe PID 652 wrote to memory of 864 652 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ab72281000874e379981e17a28bcf530b2293ab99a75ce6c9e778d28ad88707.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ab72281000874e379981e17a28bcf530b2293ab99a75ce6c9e778d28ad88707.dll,#12⤵PID:864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 8003⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-115-0x0000000000000000-mapping.dmp
-
memory/864-117-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/864-118-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/864-116-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/864-119-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/864-120-0x00000000008C0000-0x00000000008C6000-memory.dmpFilesize
24KB