Analysis
- max time kernel
99s - max time network
104s - platform
windows10_x64 - resource
win10v20210408 - submitted
07/05/2021, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
85882937_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
85882937_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 85882937_by_Libranalysis.dll
- Size 162KB
- Sample210507-kxaemr589s
- SHA256 44e0c2f0ecf484f7274c04effcabd2fcacf59cfcd1837026615949384ac082c0
- MD5 85882937fba25de514ae2a8bdfca00ec
- SHA1 ebd9ec03fd450d6945300ea91ae613824800fa3b
- SHA512 5d525f70ddafb4f9eccf18bba7571d3da3b813387643f6b55c53ff6bb2c597f7e7e0110a3d9539fecd8997fe1217c7cc2fb62fc05346c0e7f0641863c09b468b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2860 created 1164 2860 WerFault.exe 70 - Program crash 2 IoCs
pid pid_target Process procid_target 3084 1164 WerFault.exe 70 2860 1164 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 3084 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3084 WerFault.exe Token: SeBackupPrivilege 3084 WerFault.exe Token: SeDebugPrivilege 3084 WerFault.exe Token: SeDebugPrivilege 2860 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 816 wrote to memory of 1164 816 rundll32.exe 70 PID 816 wrote to memory of 1164 816 rundll32.exe 70 PID 816 wrote to memory of 1164 816 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\85882937_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\85882937_by_Libranalysis.dll,#12⤵PID:1164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-