Analysis
- max time kernel
25s - max time network
111s - platform
windows10_x64 - resource
win10v20210410 - submitted
05/05/2021, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
ac724d53_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ac724d53_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target ac724d53_by_Libranalysis.dll
- Size 162KB
- Sample210505-e18shs7g72
- SHA256 a933f25d4fe9559e3bb3ed7eb05f166913239c7557ad00e9cb9a80ae65d0d65c
- MD5 ac724d53eb264399030ea53d1601c97e
- SHA1 f24e9421640755f5b7f017f4d274d4f2cca0c77e
- SHA512 8f315938f1d6aeee15bf350974e0b04890a51f8cb9978ca0f48ab05940f21eee7c6546701f498ce16f3e7af958d814a638db7ddd3d041edebb9bc4f6bded159a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3736 created 3160 3736 WerFault.exe 69 - Program crash 2 IoCs
pid pid_target Process procid_target 1264 3160 WerFault.exe 69 3736 3160 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1264 WerFault.exe Token: SeBackupPrivilege 1264 WerFault.exe Token: SeDebugPrivilege 1264 WerFault.exe Token: SeDebugPrivilege 3736 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2232 wrote to memory of 3160 2232 rundll32.exe 69 PID 2232 wrote to memory of 3160 2232 rundll32.exe 69 PID 2232 wrote to memory of 3160 2232 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac724d53_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac724d53_by_Libranalysis.dll,#12⤵PID:3160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 5883⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-