Analysis
- max time kernel
34s - max time network
111s - platform
windows10_x64 - resource
win10v20210408 - submitted
08/05/2021, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
85835671_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
85835671_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 85835671_by_Libranalysis.dll
- Size 162KB
- Sample210508-sgewadayxe
- SHA256 b9b8f3f89933ffa376b3349232fda67789173c3e710291f2f020751b82e32e89
- MD5 8583567183ab346595737db81d44be66
- SHA1 cd8b96a0887e78023cac89e8c52595d05acfea4e
- SHA512 f8052eefecbbd1d0ec75464470d9339866e440ccd1d562df47e6b2b46c18da674b400794e7123c59f44b5acd90527eca4441f6f42269d11e7136a1ee4329556b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 640 created 4880 640 WerFault.exe 69 - Program crash 2 IoCs
pid pid_target Process procid_target 424 4880 WerFault.exe 69 640 4880 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 424 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 424 WerFault.exe Token: SeBackupPrivilege 424 WerFault.exe Token: SeDebugPrivilege 424 WerFault.exe Token: SeDebugPrivilege 640 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4804 wrote to memory of 4880 4804 rundll32.exe 69 PID 4804 wrote to memory of 4880 4804 rundll32.exe 69 PID 4804 wrote to memory of 4880 4804 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\85835671_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\85835671_by_Libranalysis.dll,#12⤵PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 6083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-