Analysis
- max time kernel
74s - max time network
137s - platform
windows10_x64 - resource
win10v20210410 - submitted
04/05/2021, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
f9ea6371_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f9ea6371_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target f9ea6371_by_Libranalysis.dll
- Size 162KB
- Sample210504-pabkjs6jln
- SHA256 7b654f504ac778afb8134c0672a17de5cddb7c5dde91e0f4ecebcbda703bca42
- MD5 f9ea63710e2aa69d38cb71788a4b858b
- SHA1 b5b05631f177efdb0431ba4d416eeb5e4f5de7ae
- SHA512 baf1a2b4085436490335463def4148827e90a5343e661fdd56180ef9de940b0dca66b18ffffaaf0b9bab8e981f16910c3c4192e799126d83941d86987dd7d920
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2740 created 2768 2740 WerFault.exe 36 - Program crash 2 IoCs
pid pid_target Process procid_target 1112 2768 WerFault.exe 36 2740 2768 WerFault.exe 36 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1112 WerFault.exe Token: SeBackupPrivilege 1112 WerFault.exe Token: SeDebugPrivilege 1112 WerFault.exe Token: SeDebugPrivilege 2740 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4084 wrote to memory of 2768 4084 rundll32.exe 36 PID 4084 wrote to memory of 2768 4084 rundll32.exe 36 PID 4084 wrote to memory of 2768 4084 rundll32.exe 36
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9ea6371_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9ea6371_by_Libranalysis.dll,#12⤵PID:2768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 6283⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 6443⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-