Analysis
-
max time kernel
123s -
max time network
174s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 00:56
Static task
static1
Behavioral task
behavioral1
Sample
d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll
Resource
win10-en-20211208
General
-
Target
d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll
-
Size
164KB
-
MD5
2e0d0aaed04118efd3f35aee6246ac1f
-
SHA1
73d6f1534e3a88b3dd0becaf16a450309c57be75
-
SHA256
d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c
-
SHA512
d3c126c38e19cdde8a85e6b61cf432fdcc329a018dc37a8e5725747c871113d43fe2ce5f7cb4765a9321585643b52e9570cac5fb0d9d85b49d41f5f0d486c371
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 520 created 3760 520 WerFault.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 520 3760 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe 520 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 520 WerFault.exe Token: SeBackupPrivilege 520 WerFault.exe Token: SeDebugPrivilege 520 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2708 wrote to memory of 3760 2708 rundll32.exe rundll32.exe PID 2708 wrote to memory of 3760 2708 rundll32.exe rundll32.exe PID 2708 wrote to memory of 3760 2708 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 7803⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3760-118-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/3760-117-0x0000000002840000-0x000000000284A000-memory.dmpFilesize
40KB
-
memory/3760-120-0x0000000002C60000-0x0000000002C61000-memory.dmpFilesize
4KB
-
memory/3760-119-0x0000000002870000-0x000000000291E000-memory.dmpFilesize
696KB
-
memory/3760-121-0x0000000002C70000-0x0000000002C76000-memory.dmpFilesize
24KB