Analysis
- max time kernel
23s - max time network
116s - platform
windows10_x64 - resource
win10v20210410 - submitted
12/05/2021, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
bf3ce8f5_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bf3ce8f5_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target bf3ce8f5_by_Libranalysis.dll
- Size 162KB
- Sample210512-e12gtp9faj
- SHA256 7e5ae84ab1ce56d724b9942d4dba3527ee4da23c19775bec806de93936aaed55
- MD5 bf3ce8f579ea67457048e93ee4833756
- SHA1 d9baa08bc513e4928fabe906a16244b71b40e505
- SHA512 b0d73f5b87c9321b4670698d16206f96b892e8e99a0e7ea130f2f3e60abb6c9d3f5a32b223bfd6e3326869e6182b23cb66b1fc44e0f4039832f74ae96046d1e9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1016 created 3732 1016 WerFault.exe 70 - Program crash 2 IoCs
pid pid_target Process procid_target 3412 3732 WerFault.exe 70 1016 3732 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3412 WerFault.exe Token: SeBackupPrivilege 3412 WerFault.exe Token: SeDebugPrivilege 3412 WerFault.exe Token: SeDebugPrivilege 1016 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2260 wrote to memory of 3732 2260 rundll32.exe 70 PID 2260 wrote to memory of 3732 2260 rundll32.exe 70 PID 2260 wrote to memory of 3732 2260 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3ce8f5_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3ce8f5_by_Libranalysis.dll,#12⤵PID:3732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 6083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
-