2a2098b68112d69efbb077ed49089b0ac590b2c05e7044d2858c49fe76b3124d | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
27-12-2021 09:11

Sharing

Report Analysis Logs

General

Target

tmp/2a2098b68112d69efbb077ed49089b0ac590b2c05e7044d2858c49fe76b3124d.exe.dll
Size

117KB
MD5

8d6f3783b3d804d3b5ed5494b74252de
SHA1

dc751f22bed09a1efa799ae54075131906ba3e67
SHA256

2a2098b68112d69efbb077ed49089b0ac590b2c05e7044d2858c49fe76b3124d
SHA512

e35c9113e455cc8330c55798ba989f23e193099c5552ff544bc0df36006ba9259c884408b9831c41327054a4cdb1f54bcc9459d6a9642c81b65cb677d06fde17

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2640 3596 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2640 WerFault.exe
Token: SeBackupPrivilege 2640 WerFault.exe
Token: SeDebugPrivilege 2640 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3552 wrote to memory of 3596	3552	rundll32.exe	rundll32.exe
PID 3552 wrote to memory of 3596	3552	rundll32.exe	rundll32.exe
PID 3552 wrote to memory of 3596	3552	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tmp\2a2098b68112d69efbb077ed49089b0ac590b2c05e7044d2858c49fe76b3124d.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tmp\2a2098b68112d69efbb077ed49089b0ac590b2c05e7044d2858c49fe76b3124d.exe.dll,#1
2⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 616
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-115-0x0000000000000000-mapping.dmp

Download