e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727 | Triage

Analysis

max time kernel
120s
max time network
144s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll
Size

5KB
MD5

8ae40c8418b2c36b58d2a43153544ddd
SHA1

c5cc49b7b2cb30d19fa8fd7abff3a04d456f4b94
SHA256

e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727
SHA512

5b24f2fba4d5a25c6cfa8d1a422426c2c43a4032ecc2707bbdaf0d42deef48df95bbce2d12e0423c3569c5c8974a2c3b3a5fa39e86ffcac3372298de8e0304bb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4452 2616 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe
4452	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4452 WerFault.exe
Token: SeBackupPrivilege 4452 WerFault.exe
Token: SeDebugPrivilege 4452 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3032 wrote to memory of 2616	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2616	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2616	3032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll,#1
2⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 616
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-115-0x0000000000000000-mapping.dmp

Download