3f2681c4a608ec4c8b57c3d25a7d2acb387eb707ee7f155df2a043c013c1f43b | Triage

Analysis

max time kernel
110s
max time network
127s
platform
windows10_x64
resource
win10-en-20211014
submitted
04-11-2021 22:59

Sharing

Report Analysis Logs

General

Target

3f2681c4a608ec4c8b57c3d25a7d2acb387eb707ee7f155df2a043c013c1f43b.dll
Size

120KB
MD5

5fe97e6ac07dde840c71df15c5f8ca77
SHA1

3efddbef4a6d09f9ad9c176caad8641c6c95c9db
SHA256

3f2681c4a608ec4c8b57c3d25a7d2acb387eb707ee7f155df2a043c013c1f43b
SHA512

927bedb0cf49f8a6d719067ade8e617eb7e5eacbed33e5c78b8a93a2d26a3b3f668f7f666637c54eeb7018c4546aee7f4e01d34746ab677743134d98281b0cd2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3992 2740 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

regsvr32.exeWerFault.exe

pid	process
2740	regsvr32.exe
2740	regsvr32.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3992 WerFault.exe
Token: SeBackupPrivilege 3992 WerFault.exe
Token: SeDebugPrivilege 3992 WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2636 wrote to memory of 2740	2636	regsvr32.exe	regsvr32.exe
PID 2636 wrote to memory of 2740	2636	regsvr32.exe	regsvr32.exe
PID 2636 wrote to memory of 2740	2636	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 3128	2740	regsvr32.exe	explorer.exe
PID 2740 wrote to memory of 3128	2740	regsvr32.exe	explorer.exe
PID 2740 wrote to memory of 3128	2740	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f2681c4a608ec4c8b57c3d25a7d2acb387eb707ee7f155df2a043c013c1f43b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3f2681c4a608ec4c8b57c3d25a7d2acb387eb707ee7f155df2a043c013c1f43b.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 764
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-115-0x0000000000000000-mapping.dmp

Download