Analysis
- max time kernel
38s - max time network
101s - platform
windows10_x64 - resource
win10v20210408 - submitted
03/05/2021, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
c2a4a1c9_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c2a4a1c9_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target c2a4a1c9_by_Libranalysis.dll
- Size 162KB
- Sample210503-e4l2f5hxw6
- SHA256 079ebee56fd7d5f4431f39d39637e1af3f8a1f62a7f83c1523d87f503bedeccc
- MD5 c2a4a1c98abbfd49d48c18158da5a630
- SHA1 01594f9637efb43480fd93af449322d182989756
- SHA512 7177a7d871b609bdf36393b3ea28c421524eb09b42d0457c7717f2cb5216d0194381e19f9b9429e49d39148aec89fdeb50af9751ece31ca0c0ad3bf1d6693ad0
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1600 created 1100 1600 WerFault.exe 70 - Program crash 2 IoCs
pid pid_target Process procid_target 752 1100 WerFault.exe 70 1600 1100 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 752 WerFault.exe Token: SeBackupPrivilege 752 WerFault.exe Token: SeDebugPrivilege 752 WerFault.exe Token: SeDebugPrivilege 1600 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 672 wrote to memory of 1100 672 rundll32.exe 70 PID 672 wrote to memory of 1100 672 rundll32.exe 70 PID 672 wrote to memory of 1100 672 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a4a1c9_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a4a1c9_by_Libranalysis.dll,#12⤵PID:1100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 6323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-