Analysis
- max time kernel
56s - max time network
83s - platform
windows10_x64 - resource
win10v20210410 - submitted
11/05/2021, 08:02
Static task
static1
Behavioral task
behavioral1
Sample
364b235a_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
364b235a_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 364b235a_by_Libranalysis.dll
- Size 162KB
- Sample210511-d9bjbr5plx
- SHA256 ee24170401cbc8628516b7fd8a342cf0f0c1b46f340fca67aa51c93055225e3b
- MD5 364b235a65e875e291bb2a4eee310f38
- SHA1 0a9024a582a742145878d9e41a6f6d44e5991703
- SHA512 086567eabd1bd3dcc63bcd187c09a607efa4513b627639da934394a2467b9bfafc22eba12bbb2cf03213724af39931967573e0611e594f7791c7eba8c1356d2f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3644 created 2176 3644 WerFault.exe 64 - Program crash 2 IoCs
pid pid_target Process procid_target 2884 2176 WerFault.exe 64 3644 2176 WerFault.exe 64 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2884 WerFault.exe Token: SeBackupPrivilege 2884 WerFault.exe Token: SeDebugPrivilege 2884 WerFault.exe Token: SeDebugPrivilege 3644 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3988 wrote to memory of 2176 3988 rundll32.exe 64 PID 3988 wrote to memory of 2176 3988 rundll32.exe 64 PID 3988 wrote to memory of 2176 3988 rundll32.exe 64
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\364b235a_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\364b235a_by_Libranalysis.dll,#12⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-