Analysis
- max time kernel
150s - max time network
135s - platform
windows10_x64 - resource
win10v200722 - submitted
17/09/2020, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
b163d.pdf.dll
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b163d.pdf.dll
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target b163d.pdf.dll
- Size 211KB
- Sample200917-pxezmerars
- SHA256 9c2b9591aa625e3dd4d8eae345b24e331bf731c9d5fa6455ac8e79bd6ec5d0d0
- MD5 ad88c54c37ce7d75790df768ef14e2f5
- SHA1 298d7ba10332a0b9d220533ba337c2455d2f70e2
- SHA512 51c9b720c0a3e04d32e222b63a68e47accd3732992391897ed4db80b7160dab4cb72c150de185bc0b005878107fa556ba4a0154ff18c83e212b12aef9d847325
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- ServiceHost packer 48 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/904-2-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-3-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-4-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-5-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-6-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-8-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-9-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-10-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-11-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-13-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-14-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-15-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-16-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-17-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-18-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-20-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-21-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-22-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-23-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-24-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-27-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-26-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-28-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-29-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-30-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-31-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-32-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-34-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-35-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-36-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-37-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-38-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-39-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-41-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-42-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-43-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-44-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-45-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-46-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-47-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-48-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-50-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-51-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-52-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-53-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-54-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-55-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/904-56-0x0000000000000000-mapping.dmp servicehost - Blacklisted process makes network request 1 IoCs
flow pid Process 16 904 rundll32.exe - Program crash 5 IoCs
pid pid_target Process procid_target 1668 904 WerFault.exe 66 2920 904 WerFault.exe 66 512 904 WerFault.exe 66 2868 904 WerFault.exe 66 1176 904 WerFault.exe 66 - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 1668 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 1668 WerFault.exe Token: SeBackupPrivilege 1668 WerFault.exe Token: SeDebugPrivilege 1668 WerFault.exe Token: SeDebugPrivilege 2920 WerFault.exe Token: SeDebugPrivilege 512 WerFault.exe Token: SeDebugPrivilege 2868 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 648 wrote to memory of 904 648 rundll32.exe 66 PID 648 wrote to memory of 904 648 rundll32.exe 66 PID 648 wrote to memory of 904 648 rundll32.exe 66
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b163d.pdf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b163d.pdf.dll,#12⤵
- Blacklisted process makes network request
PID:904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 6643⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 7923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 8563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 9803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 12163⤵
- Program crash
PID:1176
-
-