Analysis
- max time kernel
95s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
11/05/2021, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
d9411b6e_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d9411b6e_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target d9411b6e_by_Libranalysis.dll
- Size 162KB
- Sample210511-ehtce58dqa
- SHA256 4fced48715bfb38deed045df8610229f3986090b64d28f56bcb501fe887ef584
- MD5 d9411b6e00047cfd99a4cb2fe544f434
- SHA1 bfa5b860dc703b0917a7aa25681a88d5c45dcdae
- SHA512 8564616f1f6ee8d19b8a0ce97b62f039b118318a328d834bc14ec877f62a3d31a544a7bcb516eab3295a6902c64d957a7152b31026dc1d8be1be28ede7d7df4d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1324 created 976 1324 WerFault.exe 26 - Program crash 2 IoCs
pid pid_target Process procid_target 3880 976 WerFault.exe 26 1324 976 WerFault.exe 26 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3880 WerFault.exe Token: SeBackupPrivilege 3880 WerFault.exe Token: SeDebugPrivilege 3880 WerFault.exe Token: SeDebugPrivilege 1324 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2232 wrote to memory of 976 2232 rundll32.exe 26 PID 2232 wrote to memory of 976 2232 rundll32.exe 26 PID 2232 wrote to memory of 976 2232 rundll32.exe 26
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d9411b6e_by_Libranalysis.dll,#11⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 6162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 6082⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d9411b6e_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2232