a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa | Triage

Analysis

max time kernel
160s
max time network
180s
platform
windows10_x64
resource
win10-en-20211208
submitted
29-01-2022 03:34

Sharing

Report Analysis Logs

General

Target

a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa.dll
Size

209KB
MD5

8afdfd6d035b3c616dc37894a15206b4
SHA1

a9143b0fc38b6329d5dfbffc4aa91b5f57211da0
SHA256

a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa
SHA512

cf6b20557576e9d2d4c4e3c6119483b29432549335960ec89679a7132843c15c7b0b9bcc52494bff301b5cf9e9a6ebef21fa6d2f741e21bb6f75ef2b123721f0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

412 3068 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe
412	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 412 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa.dll,#1
1⤵
PID:3068

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3068 -s 280
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads