Analysis
- max time kernel
110s - max time network
111s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/04/2021, 02:54
Static task
static1
Behavioral task
behavioral1
Sample
56dcc7e5_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
56dcc7e5_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 56dcc7e5_by_Libranalysis.dll
- Size 162KB
- Sample210429-ykh6lt332n
- SHA256 8cb686e3865e02e2b93a6c73ccf6c3dfd4bb0a3efa1e1de08c93d20cf00387e2
- MD5 56dcc7e59560e96b83b8fefa6250a76e
- SHA1 5e3a10fc7b29c7b46413099441a140ae36c4482c
- SHA512 aa1b63c0859b50b5d4691d4d989d1431c0071d55fb36a1a04f7b9ddacd109dc46c3611fbc7192617345ada4dbf48f3a28b118be2e017dbc4991211adfff3358a
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 2 IoCs
pid pid_target Process procid_target 3020 1340 WerFault.exe 70 1216 1340 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe 1216 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3020 WerFault.exe Token: SeBackupPrivilege 3020 WerFault.exe Token: SeDebugPrivilege 3020 WerFault.exe Token: SeDebugPrivilege 1216 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 808 wrote to memory of 1340 808 rundll32.exe 70 PID 808 wrote to memory of 1340 808 rundll32.exe 70 PID 808 wrote to memory of 1340 808 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56dcc7e5_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56dcc7e5_by_Libranalysis.dll,#12⤵PID:1340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 6323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 6123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-