Analysis
- max time kernel
29s - max time network
111s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/05/2021, 23:02
Static task
static1
Behavioral task
behavioral1
Sample
88bd20c4_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
88bd20c4_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 88bd20c4_by_Libranalysis.dll
- Size 162KB
- Sample210506-x51n3bqaae
- SHA256 5ded0a945bd09f7666a7273fb0861c6b65d090c4983d17540dff2c67a3be94d7
- MD5 88bd20c411be56f35caafd519cd488be
- SHA1 5d97e46632bbe25bf91beb996a0f5993db8dd67d
- SHA512 2282b85f887a0e896020f3bdf54915f973b30575845f9a9ea4d07376eea4338cafd86307a3945d55e2a478d0c12972d14c277c2167fcaa26b94f31b5f0d096c3
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 2 IoCs
pid pid_target Process procid_target 3156 3612 WerFault.exe 69 3376 3612 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3156 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe 3376 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3156 WerFault.exe Token: SeBackupPrivilege 3156 WerFault.exe Token: SeDebugPrivilege 3156 WerFault.exe Token: SeDebugPrivilege 3376 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4024 wrote to memory of 3612 4024 rundll32.exe 69 PID 4024 wrote to memory of 3612 4024 rundll32.exe 69 PID 4024 wrote to memory of 3612 4024 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88bd20c4_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88bd20c4_by_Libranalysis.dll,#12⤵PID:3612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-