Analysis
- max time kernel
127s - max time network
128s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/05/2021, 12:03
Static task
static1
Behavioral task
behavioral1
Sample
5b21f7f5_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5b21f7f5_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 5b21f7f5_by_Libranalysis.dll
- Size 162KB
- Sample210506-mlrcwsyl2x
- SHA256 e4446d6ed1d2f405c4fc42f7f3531093ae3f15b1c5cd4bf9bd497ddc6c04ebbb
- MD5 5b21f7f5c695cd624d7b286aaec7e781
- SHA1 d98d498bcd3d55cfc20ee5aa06f1c25fabdb67fc
- SHA512 4ca3afdb29496974e6e66a2ee05ab955e2144ead4385e86b043d4b4f3726d111d92e23ad3aa833ba7bf15ce219236ad0c5dfb4b481462ef5c1db91cbcd0853c2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3612 created 3480 3612 WerFault.exe 55 - Program crash 2 IoCs
pid pid_target Process procid_target 3916 3480 WerFault.exe 55 3612 3480 WerFault.exe 55 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe 3612 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3916 WerFault.exe Token: SeBackupPrivilege 3916 WerFault.exe Token: SeDebugPrivilege 3916 WerFault.exe Token: SeDebugPrivilege 3612 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2232 wrote to memory of 3480 2232 rundll32.exe 55 PID 2232 wrote to memory of 3480 2232 rundll32.exe 55 PID 2232 wrote to memory of 3480 2232 rundll32.exe 55
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5b21f7f5_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5b21f7f5_by_Libranalysis.dll,#12⤵PID:3480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 6283⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 5683⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-