Analysis
-
max time kernel
118s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 00:49
Static task
static1
Behavioral task
behavioral1
Sample
e3bb6566d7843fb3adb553dbb6f7c7d38bc94eeb72000c0a516397842123c7f2.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e3bb6566d7843fb3adb553dbb6f7c7d38bc94eeb72000c0a516397842123c7f2.dll
Resource
win10-en-20211208
General
-
Target
e3bb6566d7843fb3adb553dbb6f7c7d38bc94eeb72000c0a516397842123c7f2.dll
-
Size
166KB
-
MD5
d846ff7ad571d6f9b9313951f03d89d6
-
SHA1
8869b1b3c65ad6384dd1e52420c6482e8e3daf6f
-
SHA256
e3bb6566d7843fb3adb553dbb6f7c7d38bc94eeb72000c0a516397842123c7f2
-
SHA512
1149de23460ab43abbad09f42bd1b9c7574e2acd9a8a71ef10b3aa8c8f2a9e953194cc6cf1983812effafa25401c3e0dd42582cf08b363e8b3a8628cc1ac41eb
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2716 created 2300 2716 WerFault.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2716 2300 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2716 WerFault.exe Token: SeBackupPrivilege 2716 WerFault.exe Token: SeDebugPrivilege 2716 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1860 wrote to memory of 2300 1860 rundll32.exe rundll32.exe PID 1860 wrote to memory of 2300 1860 rundll32.exe rundll32.exe PID 1860 wrote to memory of 2300 1860 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e3bb6566d7843fb3adb553dbb6f7c7d38bc94eeb72000c0a516397842123c7f2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e3bb6566d7843fb3adb553dbb6f7c7d38bc94eeb72000c0a516397842123c7f2.dll,#12⤵PID:2300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 7443⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2300-216-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/2300-215-0x0000000000600000-0x000000000074A000-memory.dmpFilesize
1.3MB
-
memory/2300-217-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB
-
memory/2300-218-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB
-
memory/2300-219-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB