Analysis
- max time kernel
25s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
03/05/2021, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
1b12ece3_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1b12ece3_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 1b12ece3_by_Libranalysis.dll
- Size 162KB
- Sample210503-t2hr1wn7da
- SHA256 d9177279ee0bd7f2b03f9a3b2e5dd1fdfd4bb9c794349ead272361b92beadce8
- MD5 1b12ece38d9c4599b7060b10fbf99480
- SHA1 58aaf6dfb60ff4ce11d500e1635d181edde7db07
- SHA512 d7684d927d3617563e5532e572f6f63543861baca09e19def6b6a02dd0eafb4e24cbe099183b7297bf78be8b09829f984042d133ce022c4e820456e995e1071f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3408 created 3844 3408 WerFault.exe 70 - Program crash 2 IoCs
pid pid_target Process procid_target 1172 3844 WerFault.exe 70 3408 3844 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 1172 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe 3408 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1172 WerFault.exe Token: SeBackupPrivilege 1172 WerFault.exe Token: SeDebugPrivilege 1172 WerFault.exe Token: SeDebugPrivilege 3408 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3692 wrote to memory of 3844 3692 rundll32.exe 70 PID 3692 wrote to memory of 3844 3692 rundll32.exe 70 PID 3692 wrote to memory of 3844 3692 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b12ece3_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b12ece3_by_Libranalysis.dll,#12⤵PID:3844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 6203⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 6323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408
-
-