Analysis

  • max time kernel
    118s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 07:55

General

  • Target

    292a1fa19c845a2639eb4b62401d17950c99fb31d7916f83a8ab24c974489e4f.dll

  • Size

    164KB

  • MD5

    a9948e77a33bce53f2e6c53c1a83629f

  • SHA1

    eaa69f7d34b737f5d9d47ade839826b8da2aab5d

  • SHA256

    292a1fa19c845a2639eb4b62401d17950c99fb31d7916f83a8ab24c974489e4f

  • SHA512

    0feaebc9eabe6ba8b9d704a7aa88b49b460ebd9409933bf650cbdbc88df204eab981228c1e7d6119455e057324dd73c169323d1341d8ef1b2dbc70bb2818c4e3

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\292a1fa19c845a2639eb4b62401d17950c99fb31d7916f83a8ab24c974489e4f.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\292a1fa19c845a2639eb4b62401d17950c99fb31d7916f83a8ab24c974489e4f.dll,#1
      2⤵
        PID:788
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 752
          3⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2484

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/788-115-0x0000000000680000-0x00000000006A3000-memory.dmp

      Filesize

      140KB

    • memory/788-116-0x0000000000680000-0x00000000006A3000-memory.dmp

      Filesize

      140KB

    • memory/788-117-0x0000000000EB0000-0x0000000000ED3000-memory.dmp

      Filesize

      140KB