149df23d9a0e658f401478ee95a284a35b58a1d30d9ea420e3147034f5fedbe5 | Triage

Analysis

max time kernel
121s
max time network
148s
platform
windows10_x64
resource
win10-en-20211208
submitted
25-01-2022 10:03

Sharing

Report Analysis Logs

General

Target

locale_772.dll
Size

301KB
MD5

69e1fa92dc8430cb1cacb6c2060cff26
SHA1

22fa67584a986738ee77d204aa7290f2a6a6cdfb
SHA256

c5b9eab2b92b03206b6d46e9d5b478e5e0cbf9917a5c3b17eafbcf90f987f454
SHA512

8f3463e172b6b9c1da705a07326de906c29c0d549f12911fd63ba15b1f42c23fcd8cf0be0ec9834bf8331e5fcf721406c950b49b68fcae790b4f042e309b4031

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

11 2776 rundll32.exe
13 2776 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3948 2776 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3948 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\locale_772.dll,#1
1⤵
- Blocklisted process makes network request
PID:2776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2776 -s 932
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-115-0x00007FFBC2FE0000-0x00007FFBC31BB000-memory.dmp

Filesize
1.9MB

Download