Analysis
- max time kernel
134s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/04/2021, 09:41
Static task
static1
Behavioral task
behavioral1
Sample
0c295416_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0c295416_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 0c295416_by_Libranalysis.dll
- Size 162KB
- Sample210429-dvk8scrtwe
- SHA256 651c87fba47898d7f3294e1f3dc355ee7f857c8e3e2cdeba4e8d3154227fe942
- MD5 0c295416da344768722ee2fff5d4bd3c
- SHA1 ad316fdc8cc1b407424555c9b924e87673af8cc0
- SHA512 148314d14af5d9c7456b31197bef0a7039e9d35544548737acecac314f44444f4dcde977e617ab4742b874b85f388aae70653ae96748ea5c6d938c0a1df812cc
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3272 created 1668 3272 WerFault.exe 71 - Program crash 2 IoCs
pid pid_target Process procid_target 1448 1668 WerFault.exe 71 3272 1668 WerFault.exe 71 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 1448 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1448 WerFault.exe Token: SeBackupPrivilege 1448 WerFault.exe Token: SeDebugPrivilege 1448 WerFault.exe Token: SeDebugPrivilege 3272 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 644 wrote to memory of 1668 644 rundll32.exe 71 PID 644 wrote to memory of 1668 644 rundll32.exe 71 PID 644 wrote to memory of 1668 644 rundll32.exe 71
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c295416_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c295416_by_Libranalysis.dll,#12⤵PID:1668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 6083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-