7d4d34ecddd559c796cd7adf4279fced47c10f23c4311700e32f0e3fa758c4f3 | Triage

Analysis

max time kernel
119s
max time network
151s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:44

Sharing

Report Analysis Logs

General

Target

7d4d34ecddd559c796cd7adf4279fced47c10f23c4311700e32f0e3fa758c4f3.dll
Size

164KB
MD5

3fbc3b4cd00a2346362b930d991e195d
SHA1

30bf62a78b6386c4dac460fe0e09496c522b6f2e
SHA256

7d4d34ecddd559c796cd7adf4279fced47c10f23c4311700e32f0e3fa758c4f3
SHA512

e24112393c60a205b5e789723995c2b20e2f3813ec4f3f00fba51ef09b045354b93ce4b7ba50a53c4aea3f1e38766b90dade747d9da3ff0fbd08986b14f3f814

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3996 created 3328 3996 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3996 3328 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3996 WerFault.exe
Token: SeBackupPrivilege 3996 WerFault.exe
Token: SeDebugPrivilege 3996 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2668 wrote to memory of 3328	2668	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 3328	2668	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 3328	2668	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d4d34ecddd559c796cd7adf4279fced47c10f23c4311700e32f0e3fa758c4f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d4d34ecddd559c796cd7adf4279fced47c10f23c4311700e32f0e3fa758c4f3.dll,#1
2⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 824
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3328-161-0x0000000002DE0000-0x0000000002F2A000-memory.dmp

Filesize
1.3MB

Download
memory/3328-164-0x0000000002DE0000-0x0000000002F2A000-memory.dmp

Filesize
1.3MB

Download
memory/3328-166-0x0000000002DE0000-0x0000000002F2A000-memory.dmp

Filesize
1.3MB

Download