fd6ec140c05e1ad7282ba7a43075a7c60a6a9b8374e3e905878e850be78b38e4 | Triage

Analysis

max time kernel
150s
max time network
161s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

fd6ec140c05e1ad7282ba7a43075a7c60a6a9b8374e3e905878e850be78b38e4.bin.dll
Size

6KB
MD5

e518cf05ae5c1aad519df0baff8ae433
SHA1

2c71785717f729a1b02d50c8e229965e213cadc2
SHA256

fd6ec140c05e1ad7282ba7a43075a7c60a6a9b8374e3e905878e850be78b38e4
SHA512

0258fd5aa46873370cde2de5975c70f5559c8ddb6f8b80d309ea773ee7656f4c4680121aa09b7f362da144b2a7b01bee81760ecbb3b2f2838f7559a6187d6a1e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3816	2596	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd6ec140c05e1ad7282ba7a43075a7c60a6a9b8374e3e905878e850be78b38e4.bin.dll,#1
1⤵
PID:2596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2596 -s 276
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads