8e03f92cc147e865d6e3ca6296e84683e13993e47af6203d8fcb3927c968c7f3 | Triage

Analysis

max time kernel
121s
max time network
162s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:36

Sharing

Report Analysis Logs

General

Target

8e03f92cc147e865d6e3ca6296e84683e13993e47af6203d8fcb3927c968c7f3.dll
Size

164KB
MD5

0648162d538cefee7c4548778de06399
SHA1

c47f9bc817059f7bbd9e65533b86f41061831898
SHA256

8e03f92cc147e865d6e3ca6296e84683e13993e47af6203d8fcb3927c968c7f3
SHA512

c1e3f38d05b433efa5c189acc3dbb8c1264d5cb960903e2eee570a1bc6ba952669e147628db2ee0a3948e8bc844376f7a66b8775baf619eda5e80995e5984cfe

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3956 created 3580 3956 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3956 3580 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3956 WerFault.exe
Token: SeBackupPrivilege 3956 WerFault.exe
Token: SeDebugPrivilege 3956 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2780 wrote to memory of 3580	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 3580	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 3580	2780	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e03f92cc147e865d6e3ca6296e84683e13993e47af6203d8fcb3927c968c7f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e03f92cc147e865d6e3ca6296e84683e13993e47af6203d8fcb3927c968c7f3.dll,#1
2⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 800
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3580-115-0x0000000000A10000-0x0000000000B5A000-memory.dmp

Filesize
1.3MB

Download
memory/3580-116-0x0000000000A10000-0x0000000000B5A000-memory.dmp

Filesize
1.3MB

Download
memory/3580-117-0x0000000000A80000-0x0000000000D34000-memory.dmp

Filesize
2.7MB

Download
memory/3580-118-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Filesize
24KB

Download