Analysis
- max time kernel
32s - max time network
115s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/05/2021, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
e7500aff_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e7500aff_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target e7500aff_by_Libranalysis.dll
- Size 162KB
- Sample210512-eaa82y89f6
- SHA256 f471dd00f4b6a468217499ea6c8db72b3c9fb26c1e16fcb6f50ef90f0ba13dfa
- MD5 e7500aff95386532e51165c451974fb5
- SHA1 dae113f6ccebcb82863bf760854f5f89b51431fd
- SHA512 a630cf644884cbbf95cd9dffec7a85a011832b58847c40908e2360459d6619da773a6b87ad77b64a70df95485315a3ffb0c170f47cf0a4f94ed4850a3c6fde5e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1988 created 1116 1988 WerFault.exe 70 - Program crash 2 IoCs
pid pid_target Process procid_target 2904 1116 WerFault.exe 70 1988 1116 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2904 WerFault.exe Token: SeBackupPrivilege 2904 WerFault.exe Token: SeDebugPrivilege 2904 WerFault.exe Token: SeDebugPrivilege 1988 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 640 wrote to memory of 1116 640 rundll32.exe 70 PID 640 wrote to memory of 1116 640 rundll32.exe 70 PID 640 wrote to memory of 1116 640 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e7500aff_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e7500aff_by_Libranalysis.dll,#12⤵PID:1116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 6203⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 6323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-