Analysis
-
max time kernel
119s -
max time network
180s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:14
Static task
static1
Behavioral task
behavioral1
Sample
b7e7878b4f87f1b29fb3c7002d90196c69bffe1eb70ae08d2563b79e1bc41a06.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b7e7878b4f87f1b29fb3c7002d90196c69bffe1eb70ae08d2563b79e1bc41a06.dll
Resource
win10-en-20211208
General
-
Target
b7e7878b4f87f1b29fb3c7002d90196c69bffe1eb70ae08d2563b79e1bc41a06.dll
-
Size
164KB
-
MD5
d8e850611733076fc9d523b586e76ff7
-
SHA1
213ae7883211b3a5f36c9e30429057c31f7f28c5
-
SHA256
b7e7878b4f87f1b29fb3c7002d90196c69bffe1eb70ae08d2563b79e1bc41a06
-
SHA512
b20d3c6efef33628279de932a2dbba9f33e9ee356ce3ff4898e34e65df44bbaf6a45b553a906b6d923a73a51acbece7ddc3cb39667fa90e5761b0cbcc4a9129b
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1068 created 772 1068 WerFault.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1068 772 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe 1068 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1068 WerFault.exe Token: SeBackupPrivilege 1068 WerFault.exe Token: SeDebugPrivilege 1068 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3044 wrote to memory of 772 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 772 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 772 3044 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b7e7878b4f87f1b29fb3c7002d90196c69bffe1eb70ae08d2563b79e1bc41a06.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b7e7878b4f87f1b29fb3c7002d90196c69bffe1eb70ae08d2563b79e1bc41a06.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 7483⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-163-0x00000000031F0000-0x00000000031F1000-memory.dmpFilesize
4KB
-
memory/772-161-0x0000000003100000-0x000000000310A000-memory.dmpFilesize
40KB
-
memory/772-168-0x0000000003590000-0x00000000035B3000-memory.dmpFilesize
140KB
-
memory/772-166-0x0000000003590000-0x00000000035B3000-memory.dmpFilesize
140KB
-
memory/772-233-0x0000000003590000-0x00000000035B3000-memory.dmpFilesize
140KB