77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b | Triage

Analysis

max time kernel
122s
max time network
144s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:47

Sharing

Report Analysis Logs

General

Target

77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b.dll
Size

164KB
MD5

abfba91a82b5a23af15c70c0d970c51d
SHA1

c7f8ab5c08c14ff16e0fe1fb467e44f760c51134
SHA256

77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b
SHA512

b622b8e9518141d226e417f71ef892a11e1e8fd1c6a513376ef8e4b0609038e4a0aff447ed0602f9500a5c3f10458cb99a54372ed59fbeeb746695fffa16bd00

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 420 created 2712 420 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

420 2712 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 420 WerFault.exe
Token: SeBackupPrivilege 420 WerFault.exe
Token: SeDebugPrivilege 420 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2676 wrote to memory of 2712	2676	rundll32.exe	rundll32.exe
PID 2676 wrote to memory of 2712	2676	rundll32.exe	rundll32.exe
PID 2676 wrote to memory of 2712	2676	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b.dll,#1
2⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 844
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-115-0x0000000000B20000-0x0000000000D34000-memory.dmp

Filesize
2.1MB

Download
memory/2712-116-0x0000000000B20000-0x0000000000D34000-memory.dmp

Filesize
2.1MB

Download
memory/2712-117-0x0000000000B20000-0x0000000000D34000-memory.dmp

Filesize
2.1MB

Download
memory/2712-118-0x0000000000B20000-0x0000000000D34000-memory.dmp

Filesize
2.1MB

Download