Analysis
- max time kernel
69s - max time network
110s - platform
windows10_x64 - resource
win10v20210410 - submitted
08/05/2021, 00:01
Static task
static1
Behavioral task
behavioral1
Sample
81614627_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
81614627_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 81614627_by_Libranalysis.dll
- Size 162KB
- Sample210508-e8m3778p26
- SHA256 83afdff43b9917a7abe322b64fe00b839232f1510f64801a438d6c424ecfb64a
- MD5 81614627c336ad84eac65150abffb2cf
- SHA1 e2b91c9955c6951fc3ba7b9c2b7c92a072362f64
- SHA512 5be4c2851d9b3efef96be7bd4cdcdf95d8ab1b27bac4569aa3b250d13ac7fc2a04c42c171a72618de3250088854ee2786c90b91be4c512321d6ef60d0a703096
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 2 IoCs
pid pid_target Process procid_target 3868 3264 WerFault.exe 70 344 3264 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3868 WerFault.exe Token: SeBackupPrivilege 3868 WerFault.exe Token: SeDebugPrivilege 3868 WerFault.exe Token: SeDebugPrivilege 344 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3892 wrote to memory of 3264 3892 rundll32.exe 70 PID 3892 wrote to memory of 3264 3892 rundll32.exe 70 PID 3892 wrote to memory of 3264 3892 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\81614627_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\81614627_by_Libranalysis.dll,#12⤵PID:3264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 6323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 6123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:344
-
-