ddc9e19c37d065da000be3c0493553ff5f25d41b98d25aff7037945a581d58ef | Triage

Analysis

max time kernel
122s
max time network
140s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:52

Sharing

Report Analysis Logs

General

Target

ddc9e19c37d065da000be3c0493553ff5f25d41b98d25aff7037945a581d58ef.dll
Size

160KB
MD5

066dfe7ca544e409154decfbf7015582
SHA1

dbb76af7c7c01f1a599ce0d7017ef2c97665d263
SHA256

ddc9e19c37d065da000be3c0493553ff5f25d41b98d25aff7037945a581d58ef
SHA512

4587de786ec8a984ddd4bb18e39516e962ab051a1976cb6f6d11a74e8dd461d48fbdfb6780b9c42be667c1f3bcfe490e155ec71e6f5d471b36f19d571fd0d1cb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3504 2756 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe
3504	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3504 WerFault.exe
Token: SeBackupPrivilege 3504 WerFault.exe
Token: SeDebugPrivilege 3504 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2680 wrote to memory of 2756	2680	rundll32.exe	rundll32.exe
PID 2680 wrote to memory of 2756	2680	rundll32.exe	rundll32.exe
PID 2680 wrote to memory of 2756	2680	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddc9e19c37d065da000be3c0493553ff5f25d41b98d25aff7037945a581d58ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddc9e19c37d065da000be3c0493553ff5f25d41b98d25aff7037945a581d58ef.dll,#1
2⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 584
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...