Analysis
- max time kernel
123s - max time network
124s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/05/2021, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
1bd524a7_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1bd524a7_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 1bd524a7_by_Libranalysis.dll
- Size 162KB
- Sample210506-9bkbz2d2gx
- SHA256 f0a1a793cb806425e9b152cbf043fab01b5c4e0f75e2ffadf28384dba1284686
- MD5 1bd524a7f1b3e9b266fe743fc7543c97
- SHA1 2903cb7196f67ddeb15a6db62be65a90e869d6fa
- SHA512 d68a0a6b91e46ae60f9bf7d4b935cc1e39b1bf85ca5474792f926920f52537740849b9ea43a58fd976b31ec6dc981429dae7b905382b4fc6cb8045bfc44dc669
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 8 created 476 8 WerFault.exe 34 - Program crash 2 IoCs
pid pid_target Process procid_target 3400 476 WerFault.exe 34 8 476 WerFault.exe 34 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe 8 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3400 WerFault.exe Token: SeBackupPrivilege 3400 WerFault.exe Token: SeDebugPrivilege 3400 WerFault.exe Token: SeDebugPrivilege 8 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1808 wrote to memory of 476 1808 rundll32.exe 34 PID 1808 wrote to memory of 476 1808 rundll32.exe 34 PID 1808 wrote to memory of 476 1808 rundll32.exe 34
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bd524a7_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bd524a7_by_Libranalysis.dll,#12⤵PID:476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 6323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-