Analysis
- max time kernel
30s - max time network
112s - platform
windows10_x64 - resource
win10v20210408 - submitted
08/05/2021, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
ad08f9ae_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ad08f9ae_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target ad08f9ae_by_Libranalysis.dll
- Size 162KB
- Sample210508-l7n2xamdpx
- SHA256 25b794ff88d3fba4b4c8199ac89871ff377f8c99577ec3733dcbd4d98fb7b980
- MD5 ad08f9ae17ff23c919b9504945422799
- SHA1 d2e24923e85807622acf9b47b0a7d44e8c12bda9
- SHA512 288bb49b0bb9d843df08d950dbe255ba566df2a87d39e5b27e2507e36b46b4f6be0b6ec8b150da72940c6288344032410bc0388e6d43b5d3750365edddadc622
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2856 created 1824 2856 WerFault.exe 71 - Program crash 2 IoCs
pid pid_target Process procid_target 528 1824 WerFault.exe 71 2856 1824 WerFault.exe 71 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 528 WerFault.exe Token: SeBackupPrivilege 528 WerFault.exe Token: SeDebugPrivilege 528 WerFault.exe Token: SeDebugPrivilege 2856 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1824 1032 rundll32.exe 71 PID 1032 wrote to memory of 1824 1032 rundll32.exe 71 PID 1032 wrote to memory of 1824 1032 rundll32.exe 71
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad08f9ae_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad08f9ae_by_Libranalysis.dll,#12⤵PID:1824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-