Analysis

  • max time kernel
    119s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 02:36

General

  • Target

    01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d.dll

  • Size

    164KB

  • MD5

    8941ca57999f7f1b486951806cc0f9af

  • SHA1

    2e9233ec9ef70b7101749281efd14881f0a95f32

  • SHA256

    01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d

  • SHA512

    7520e0a053abf1b23f746da81d19ab6bdfaa14f580be803386f6449745ce1971be50416f5d8d3ff8620a0a7cee7501fefb90307e28749e00346f3a4561db77c6

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d.dll,#1
      2⤵
        PID:524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 804
          3⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1396

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/524-218-0x0000000005AE0000-0x0000000005B03000-memory.dmp
      Filesize

      140KB

    • memory/524-221-0x0000000005AE0000-0x0000000005B03000-memory.dmp
      Filesize

      140KB

    • memory/524-224-0x0000000005AE0000-0x0000000005B03000-memory.dmp
      Filesize

      140KB