c6f6ef975f76b6f7f163ab3266c18fec304fe063c599f8b2b91631ed02f4be90 | Triage

Analysis

max time kernel
120s
max time network
163s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

c6f6ef975f76b6f7f163ab3266c18fec304fe063c599f8b2b91631ed02f4be90.bin.dll
Size

6KB
MD5

b8fb0d53de6c906fbdb672a5aa7c4b6e
SHA1

999f6032b98130ea489e186c0afbbc4a480b0b14
SHA256

c6f6ef975f76b6f7f163ab3266c18fec304fe063c599f8b2b91631ed02f4be90
SHA512

64a16f4b376df279a7c843236f0d485ec91d070104dfab493bf28611aeea6a5ce9e1f09b20d607b617901fa31b952cf36cf1f87e8dba73d89da35c487eba7cae

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	3992	WerFault.exe	12

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6f6ef975f76b6f7f163ab3266c18fec304fe063c599f8b2b91631ed02f4be90.bin.dll,#1
1⤵
PID:3992
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3992 -s 276
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads