0ce512682a20ed28e7c0a9fa6a3a5125d4159b08e53364fc5b28aff46fc32724 | Triage

Resubmissions

30-12-2021 05:19

211230-fz1resfee7 3

24-12-2021 11:10

211224-m9t5yseaa7 10

Analysis

max time kernel
122s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

0ce512682a20ed28e7c0a9fa6a3a5125d4159b08e53364fc5b28aff46fc32724.bin.dll
Size

6KB
MD5

57fc5819505a1a7f83e005ccc2587b5d
SHA1

595de500a634374da377b10cfa0fff6496a79990
SHA256

0ce512682a20ed28e7c0a9fa6a3a5125d4159b08e53364fc5b28aff46fc32724
SHA512

7a4cf61fbf5cf7bb508df6bf3d4575cd8e091cb55f13cb8b6f2c9aa9dd1571ab7aea39c5bad8ef8283b8c96a8e1f3e06d3b26b3fb5a33c52b4245927706d07ae

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2820 2404 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2820 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ce512682a20ed28e7c0a9fa6a3a5125d4159b08e53364fc5b28aff46fc32724.bin.dll,#1
1⤵
PID:2404

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2404 -s 284
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...