bf81fbbc09954cde0f6883a4f983b8f9623a9e126a242dacf7afeafcd156679d | Triage

Analysis

max time kernel
153s
max time network
157s
platform
windows10_x64
resource
win10-en-20211208
submitted
16-12-2021 16:12

Sharing

Report Analysis Logs

General

Target

storelibir-2.dll
Size

276KB
MD5

a0656d35a382b58c75cb9fb3f5388f35
SHA1

f4da2119c184a5fbf2d7233bd3d7352fecfb50e2
SHA256

1fb68c58d9764fc0327de464152274044cb5664e6a3d3881ca1ce562e7fe59f3
SHA512

d0509c71073d1f55b5c5c485e2743f5ce8ff0042524d80d8e6e5cddea4ed4e59ad199963d5548b99d9eb646bd9d1abe45fb0d0add63ba0e427ceec2ac34bcb25

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3784 3364 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3784 WerFault.exe
Token: SeBackupPrivilege 3784 WerFault.exe
Token: SeDebugPrivilege 3784 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2196 wrote to memory of 3364	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 3364	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 3364	2196	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storelibir-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storelibir-2.dll,#1
2⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 632
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3364-116-0x0000000000000000-mapping.dmp

Download