Analysis
- max time kernel
133s - max time network
134s - platform
windows10_x64 - resource
win10v20210410 - submitted
29/04/2021, 13:11
Static task
static1
Behavioral task
behavioral1
Sample
09a681b2_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
09a681b2_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 09a681b2_by_Libranalysis.dll
- Size 162KB
- Sample210429-laz94b7eej
- SHA256 a9b60f836542339b4c07d0c8a8f4043bcde22be699e99e71f635572fb457763d
- MD5 09a681b20d628623142524124038a9b4
- SHA1 54f1d06c17fb6c60554750839302b896b695d6f0
- SHA512 d021603be0a29bb71713424a1d8a8b9b2ff9fff0a226bb8b52aa6fb8f8ba47fe8cc13196f16690578acb0251ad62b76c574903a217bfb8c44a832810a8ca5e0e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3400 created 680 3400 WerFault.exe 70 - Program crash 2 IoCs
pid pid_target Process procid_target 1316 680 WerFault.exe 70 3400 680 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1316 WerFault.exe Token: SeBackupPrivilege 1316 WerFault.exe Token: SeDebugPrivilege 1316 WerFault.exe Token: SeDebugPrivilege 3400 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1808 wrote to memory of 680 1808 rundll32.exe 70 PID 1808 wrote to memory of 680 1808 rundll32.exe 70 PID 1808 wrote to memory of 680 1808 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09a681b2_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09a681b2_by_Libranalysis.dll,#12⤵PID:680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-