Analysis
- max time kernel
129s - max time network
131s - platform
windows10_x64 - resource
win10v20210410 - submitted
12/05/2021, 16:02
Static task
static1
Behavioral task
behavioral1
Sample
e4b613ae_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e4b613ae_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target e4b613ae_by_Libranalysis.dll
- Size 162KB
- Sample210512-e19yl78hg2
- SHA256 b60fdb0e79aed9d05d5cfc84eb8548eff1e81d311caeedba7d1a39807ff54ec5
- MD5 e4b613ae3734743adbff6b165e550c18
- SHA1 09ea4e7f01bdbd70cdcc6aa84ecc84de8215b658
- SHA512 33278baa1883d33fefdd0b3a98fd10435dbe11b0a2b8b308d0cf09a4b688eff54cd1797d48e91e3266949fab7441b54727e3b1d6412c71e29fc5d5ad409fb838
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1504 created 3172 1504 WerFault.exe 69 - Program crash 2 IoCs
pid pid_target Process procid_target 3512 3172 WerFault.exe 69 1504 3172 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 3512 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3512 WerFault.exe Token: SeBackupPrivilege 3512 WerFault.exe Token: SeDebugPrivilege 3512 WerFault.exe Token: SeDebugPrivilege 1504 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2116 wrote to memory of 3172 2116 rundll32.exe 69 PID 2116 wrote to memory of 3172 2116 rundll32.exe 69 PID 2116 wrote to memory of 3172 2116 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4b613ae_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4b613ae_by_Libranalysis.dll,#12⤵PID:3172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 763⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-