Analysis
- max time kernel
35s - max time network
124s - platform
windows10_x64 - resource
win10v20210408 - submitted
30/04/2021, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
90136ec5_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
90136ec5_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 90136ec5_by_Libranalysis.dll
- Size 162KB
- Sample210430-az2emf5rma
- SHA256 377244ea5e7ec311c38cdb245f6b65b05d60995b3cef282102ed2bbce0d0ff13
- MD5 90136ec5cd652544d74bc3ffb806600d
- SHA1 36ac4cbe7a0ff855e1f1267b2e903e0a23415ca1
- SHA512 bc204cf80a7e474738696e29c9ad7a90c857146df85f01fec494677efa776b7f8813ed3377b0a05887efd926be0febc55e55b603bdcd02d1bf3cd32da6c51c3e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3796 created 604 3796 WerFault.exe 69 - Program crash 2 IoCs
pid pid_target Process procid_target 1992 604 WerFault.exe 69 3796 604 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 1992 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe 3796 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1992 WerFault.exe Token: SeBackupPrivilege 1992 WerFault.exe Token: SeDebugPrivilege 1992 WerFault.exe Token: SeDebugPrivilege 3796 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 800 wrote to memory of 604 800 rundll32.exe 69 PID 800 wrote to memory of 604 800 rundll32.exe 69 PID 800 wrote to memory of 604 800 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\90136ec5_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\90136ec5_by_Libranalysis.dll,#12⤵PID:604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 6203⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 6123⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796
-
-