aa1b86bbfc7e4e4e8c8ea81423d1875c9f6191cdc747560d94f6e64c058fca18 | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-01-2022 23:20

Sharing

Report Analysis Logs

General

Target

aa1b86bbfc7e4e4e8c8ea81423d1875c9f6191cdc747560d94f6e64c058fca18.dll
Size

86KB
MD5

70e9416833b2f933b765042f8e1ea0bc
SHA1

254f838366442d37ca6db9851ecec8e149472e12
SHA256

aa1b86bbfc7e4e4e8c8ea81423d1875c9f6191cdc747560d94f6e64c058fca18
SHA512

180ea1deb242a0f9d68cd061fc40d7f577e8cc943ef876dae1687a2408d67003cb451a684f3dfa3cfc31c1e2f2afe5d08a3d1ca6800eeecae10992f179fac86b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	2680	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1b86bbfc7e4e4e8c8ea81423d1875c9f6191cdc747560d94f6e64c058fca18.dll,#1
1⤵
PID:2680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2680 -s 280
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads