6696f5796d16c2c55bcb5f749c298f7dbaf6e58f97a469826fde76681a049239 | Triage

Analysis

max time kernel
145s
max time network
155s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:55

Sharing

Report Analysis Logs

General

Target

6696f5796d16c2c55bcb5f749c298f7dbaf6e58f97a469826fde76681a049239.dll
Size

164KB
MD5

9260fb7c3912c500c116b71149ee6d13
SHA1

1d2bd485cc2a460c76e7165dd78d9ec529e112f6
SHA256

6696f5796d16c2c55bcb5f749c298f7dbaf6e58f97a469826fde76681a049239
SHA512

4aa3f21aa5cf185b496f9c089df43a120eb496cde9cb3063ac21a8639727a527e899f674d8ecf3f9d100ba7df471596412d6c2720f61104440a430ef4ff4540a

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3140 created 2680 3140 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3140 2680 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3140 WerFault.exe
Token: SeBackupPrivilege 3140 WerFault.exe
Token: SeDebugPrivilege 3140 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2424 wrote to memory of 2680	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2680	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2680	2424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6696f5796d16c2c55bcb5f749c298f7dbaf6e58f97a469826fde76681a049239.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6696f5796d16c2c55bcb5f749c298f7dbaf6e58f97a469826fde76681a049239.dll,#1
2⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 720
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-119-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2680-118-0x00000000006D0000-0x00000000006DA000-memory.dmp

Filesize
40KB

Download
memory/2680-120-0x0000000000C90000-0x0000000000CB3000-memory.dmp

Filesize
140KB

Download
memory/2680-121-0x0000000000C90000-0x0000000000CB3000-memory.dmp

Filesize
140KB

Download