9469f92e61d75e88ccc854ac6febd2df4a2a5ee7ec4ecea152b82e05df905325 | Triage

Analysis

max time kernel
122s
max time network
131s
platform
windows10_x64
resource
win10-en-20211208
submitted
28-01-2022 17:46

Sharing

Report Analysis Logs

General

Target

9469f92e61d75e88ccc854ac6febd2df4a2a5ee7ec4ecea152b82e05df905325.dll
Size

159KB
MD5

dd1c79b8be6b33252db876bc7a6c2354
SHA1

e5dc7c8bfa285b61dda1618f0ade9c256be75d1a
SHA256

9469f92e61d75e88ccc854ac6febd2df4a2a5ee7ec4ecea152b82e05df905325
SHA512

34e1496db35c069a39b94f9e9b7478e04b57a851729816010c440f52de808b1dd7d3783a166f260aab6bb09a4bbcf2269479c287a2377e94688f7b7b413fc36a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1440	380	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe
1440	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9469f92e61d75e88ccc854ac6febd2df4a2a5ee7ec4ecea152b82e05df905325.dll,#1
1⤵
PID:380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 380 -s 296
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads