fb5a069f088077b68d0e4d94f05400d804ede55f6a342c9a600662d027da6656 | Triage

Analysis

max time kernel
141s
max time network
170s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

fb5a069f088077b68d0e4d94f05400d804ede55f6a342c9a600662d027da6656.bin.dll
Size

6KB
MD5

67f87abca302b147794c6319880e80fd
SHA1

e3a88838875d479a41492d65797e54c9bb51f486
SHA256

fb5a069f088077b68d0e4d94f05400d804ede55f6a342c9a600662d027da6656
SHA512

895e84464e2f517290dee64a7c5369f7501d64e7d8b6d3aa3b9c62adf1087b607213f8f8c67cdfc051aa96d23e0f086754fd92da3976d03a534b4e56d6f6d063

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2312 736 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe
2312	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2312 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5a069f088077b68d0e4d94f05400d804ede55f6a342c9a600662d027da6656.bin.dll,#1
1⤵
PID:736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 736 -s 292
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads