1964648e1f5546ed1080fbc26566b46ddeaa454872626df8d69b207b7a03a042 | Triage

Analysis

max time kernel
122s
max time network
168s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 07:57

Sharing

Report Analysis Logs

General

Target

1964648e1f5546ed1080fbc26566b46ddeaa454872626df8d69b207b7a03a042.dll
Size

164KB
MD5

0af67eeff2a25ebfda8f9dad73e15136
SHA1

63059028e812e75733815fa6b66a0a5ed3afe058
SHA256

1964648e1f5546ed1080fbc26566b46ddeaa454872626df8d69b207b7a03a042
SHA512

615af3ad1a2e31a3d5f48956bc82ae19bc77320aa2666ea4a37d4a1deb64fa226131b33c15f8298f7f94e4d461799d6dbdd76c979588769df45bdb16d8520695

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1364 created 3732 1364 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1364 3732 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe
1364	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1364 WerFault.exe
Token: SeBackupPrivilege 1364 WerFault.exe
Token: SeDebugPrivilege 1364 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3504 wrote to memory of 3732	3504	rundll32.exe	rundll32.exe
PID 3504 wrote to memory of 3732	3504	rundll32.exe	rundll32.exe
PID 3504 wrote to memory of 3732	3504	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1964648e1f5546ed1080fbc26566b46ddeaa454872626df8d69b207b7a03a042.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1964648e1f5546ed1080fbc26566b46ddeaa454872626df8d69b207b7a03a042.dll,#1
2⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 816
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3732-242-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3732-241-0x0000000003480000-0x000000000348A000-memory.dmp

Filesize
40KB

Download
memory/3732-243-0x00000000035F0000-0x00000000035F1000-memory.dmp

Filesize
4KB

Download
memory/3732-244-0x0000000003600000-0x0000000003601000-memory.dmp

Filesize
4KB

Download