Analysis
- max time kernel
111s - max time network
112s - platform
windows10_x64 - resource
win10v20210410 - submitted
04/05/2021, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
1d046e0c_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1d046e0c_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 1d046e0c_by_Libranalysis.dll
- Size 162KB
- Sample210504-nslrzcqa82
- SHA256 f19b4e323f09405dd7f8fb59559e02c57e268baebe87b5a04e3dae3b960d9b87
- MD5 1d046e0c812ea1ebeeb6f2cadb486e17
- SHA1 f5a712889f6d3fd5e42d5e6085e667e820b8633c
- SHA512 35b85602d2f436d2da547f87fee1e361e699e91d44dbf358a44c9fce494551473b5eea311cc73c242cc551e70e3d16f6dd7587cceb4e09fd9bec127bfada4891
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3476 created 3356 3476 WerFault.exe 51 - Program crash 2 IoCs
pid pid_target Process procid_target 2884 3356 WerFault.exe 51 3476 3356 WerFault.exe 51 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe 3476 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2884 WerFault.exe Token: SeBackupPrivilege 2884 WerFault.exe Token: SeDebugPrivilege 2884 WerFault.exe Token: SeDebugPrivilege 3476 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3984 wrote to memory of 3356 3984 rundll32.exe 51 PID 3984 wrote to memory of 3356 3984 rundll32.exe 51 PID 3984 wrote to memory of 3356 3984 rundll32.exe 51
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1d046e0c_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1d046e0c_by_Libranalysis.dll,#12⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 6083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-