Analysis
- max time kernel
33s - max time network
110s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/05/2021, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
dda39304_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dda39304_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target dda39304_by_Libranalysis.dll
- Size 162KB
- Sample210506-67l8b423fx
- SHA256 95fd99f1049ebd45f27d347057778736ae2ec5cebe461a03bf04d43e8ec83bbc
- MD5 dda39304c8887316f17dbdc55570b92c
- SHA1 b9478ef597f7adacb221a7aa049d5f72a416785d
- SHA512 8296518cacd28423f297bd790d32f9132beb7465b1be5ef0888b921468cd4e5655b4b30841bf9726ab4fec37c6c94aeaeceb36ba1dfeaebd3a1bed637bc7b378
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1972 created 1304 1972 WerFault.exe 71 - Program crash 2 IoCs
pid pid_target Process procid_target 2952 1304 WerFault.exe 71 1972 1304 WerFault.exe 71 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2952 WerFault.exe Token: SeBackupPrivilege 2952 WerFault.exe Token: SeDebugPrivilege 2952 WerFault.exe Token: SeDebugPrivilege 1972 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 364 wrote to memory of 1304 364 rundll32.exe 71 PID 364 wrote to memory of 1304 364 rundll32.exe 71 PID 364 wrote to memory of 1304 364 rundll32.exe 71
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dda39304_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dda39304_by_Libranalysis.dll,#12⤵PID:1304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-