Analysis
- max time kernel
19s - max time network
112s - platform
windows10_x64 - resource
win10v20210410 - submitted
07/05/2021, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
6ed7fb93_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6ed7fb93_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 6ed7fb93_by_Libranalysis.dll
- Size 162KB
- Sample210507-xbfezaadfa
- SHA256 9023b7eae74aebca48f7861fd3d9f971b584d4ebc8ae14219fc7bac2721f2d98
- MD5 6ed7fb93b9b08e6786e8b6339d682400
- SHA1 796374e348b5d0f5abb100f114a37f71f81716e2
- SHA512 c9486bd258c0aaae3f0b060236fd732e705dae4627b3f350d99abbb5f930977e68e541a46b7a69e7ad4592805108209264f46bb28b0e57d0d2c771788b514b6a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2628 created 3204 2628 WerFault.exe 25 - Program crash 2 IoCs
pid pid_target Process procid_target 1888 3204 WerFault.exe 25 2628 3204 WerFault.exe 25 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 1888 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1888 WerFault.exe Token: SeBackupPrivilege 1888 WerFault.exe Token: SeDebugPrivilege 1888 WerFault.exe Token: SeDebugPrivilege 2628 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3724 wrote to memory of 3204 3724 rundll32.exe 25 PID 3724 wrote to memory of 3204 3724 rundll32.exe 25 PID 3724 wrote to memory of 3204 3724 rundll32.exe 25
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ed7fb93_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ed7fb93_by_Libranalysis.dll,#12⤵PID:3204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 6323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-