bf81fbbc09954cde0f6883a4f983b8f9623a9e126a242dacf7afeafcd156679d | Triage

Analysis

max time kernel
121s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
16-12-2021 16:12

Sharing

Report Analysis Logs

General

Target

storelib.dll
Size

160KB
MD5

56dd65c393317f224a03a42bf7ac39f2
SHA1

d8921bc17fe0a6b974258f1055f0738b4a7ba8e4
SHA256

e297ad34b4deae7d030aaa0ddd8935675988e0cb2b4e71d481bf57ac05bc66d6
SHA512

ce18b16abe4d89c50cc195e6f801f6ccfe52564bf08eab25f485456c66aa237e382d9ad62c26460d86f66f5a15d1a1640c13cb1f592d416758781e903ab1c302

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4024 2768 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4024 WerFault.exe
Token: SeBackupPrivilege 4024 WerFault.exe
Token: SeDebugPrivilege 4024 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3176 wrote to memory of 2768	3176	rundll32.exe	rundll32.exe
PID 3176 wrote to memory of 2768	3176	rundll32.exe	rundll32.exe
PID 3176 wrote to memory of 2768	3176	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storelib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storelib.dll,#1
2⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 628
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2768-115-0x0000000000000000-mapping.dmp

Download