Analysis
- max time kernel
130s - max time network
133s - platform
windows10_x64 - resource
win10v20210410 - submitted
09/05/2021, 20:04
Static task
static1
Behavioral task
behavioral1
Sample
08f72adb_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
08f72adb_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 08f72adb_by_Libranalysis.dll
- Size 162KB
- Sample210509-ac3fxcbx8x
- SHA256 7c4d423b3b95d024ae8e377263753b21da7d813460f633e1cad454ef505df729
- MD5 08f72adbc478defb4b575e8e1ce60bb2
- SHA1 03325e752db3e2fce6938a1bc02292d3caa010aa
- SHA512 4f1352c80068eb1e56bea012b4e2181bf44012595bb62a9639116b3fff4b8d99d7e2f85d505646d0ed23fa58b908e9da4523fd97b875fcdc8b01308c00061827
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3540 created 3808 3540 WerFault.exe 18 - Program crash 2 IoCs
pid pid_target Process procid_target 3736 3808 WerFault.exe 18 3540 3808 WerFault.exe 18 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3736 WerFault.exe Token: SeBackupPrivilege 3736 WerFault.exe Token: SeDebugPrivilege 3736 WerFault.exe Token: SeDebugPrivilege 3540 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2188 wrote to memory of 3808 2188 rundll32.exe 18 PID 2188 wrote to memory of 3808 2188 rundll32.exe 18 PID 2188 wrote to memory of 3808 2188 rundll32.exe 18
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08f72adb_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08f72adb_by_Libranalysis.dll,#12⤵PID:3808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 5883⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540
-
-