0d80666ee6f9c233d6d99e3d89434ccf2d891dedf9ef42c7b0ac0a86d1f91737 | Triage

Analysis

max time kernel
125s
max time network
153s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

0d80666ee6f9c233d6d99e3d89434ccf2d891dedf9ef42c7b0ac0a86d1f91737.bin.dll
Size

6KB
MD5

a43579bc92fa13be2c4e4b1c18d35830
SHA1

8cdc2a169a26feb2e8b9e206c72efc71e487b0c9
SHA256

0d80666ee6f9c233d6d99e3d89434ccf2d891dedf9ef42c7b0ac0a86d1f91737
SHA512

fc681d80c9e82de47bb2a191acc0ad0fea308be530c3c6b6f50a3b8a6340825f70433998e5d56d427cd38838fb0c29d806466ebe34d7831955a5e794e663e0ee

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3076 2216 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe
3076	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3076 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d80666ee6f9c233d6d99e3d89434ccf2d891dedf9ef42c7b0ac0a86d1f91737.bin.dll,#1
1⤵
PID:2216

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2216 -s 284
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3076

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...