Analysis
- max time kernel
36s - max time network
114s - platform
windows10_x64 - resource
win10v20210408 - submitted
03/05/2021, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
83a342ff_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
83a342ff_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 83a342ff_by_Libranalysis.dll
- Size 162KB
- Sample210503-flap3cv7ne
- SHA256 8291e91832cb83c9d91248e676fb207b8ad730df7904b1afb5856c87e1bbf554
- MD5 83a342ff97de8f2740fc11a41bdafd2b
- SHA1 9a061df07a344bb5ae53985837892e4534c8e24a
- SHA512 282812b4564f7df39c338746feafd0c719a5f57744daf59472ee484e7b38332bd10e271629a32cc6167ec5f6f51222d6c72aae8a85bc5db02af2d0fc0943a8b1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2284 created 1380 2284 WerFault.exe 69 - Program crash 2 IoCs
pid pid_target Process procid_target 936 1380 WerFault.exe 69 2284 1380 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 936 WerFault.exe Token: SeBackupPrivilege 936 WerFault.exe Token: SeDebugPrivilege 936 WerFault.exe Token: SeDebugPrivilege 2284 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1380 1108 rundll32.exe 69 PID 1108 wrote to memory of 1380 1108 rundll32.exe 69 PID 1108 wrote to memory of 1380 1108 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83a342ff_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83a342ff_by_Libranalysis.dll,#12⤵PID:1380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-