be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e | Triage

Analysis

max time kernel
123s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e.bin.dll
Size

6KB
MD5

8074f73f7742309b033676cd03eb0928
SHA1

b062092193dff1948102e3db9752c17b8c69aa7c
SHA256

be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e
SHA512

a60fbb6c307be1c0f8457d72a3d805202afe5e77d43c68888d119b01a7f41a8b644d6c86363de029bcc302e2e3207ba8d1ed9e5aecdb1ea6045bad5535fb2d83

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	4060	WerFault.exe	39

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe
4596	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e.bin.dll,#1
1⤵
PID:4060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4060 -s 276
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads