Analysis
- max time kernel
27s - max time network
112s - platform
windows10_x64 - resource
win10v20210410 - submitted
13/05/2021, 00:01
Static task
static1
Behavioral task
behavioral1
Sample
ca8315a6_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ca8315a6_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target ca8315a6_by_Libranalysis.dll
- Size 162KB
- Sample210513-gwb5h3klj2
- SHA256 ce5182ef628bedae2650168c7e41ea8e251cfa95dd01574af64173bb119d9751
- MD5 ca8315a63e158d14556696de3e29f50c
- SHA1 b5c0c48c6ca07b9e3b8de3cbaa08467079f2970c
- SHA512 c18fecd1dcdbef91039fedcff545e1b8deab1f2405e5ef0bc9c4f18fa7e79102d5900ce0bbd810eab9e70ee6031981f8260a20cd9d69bc745b2903caab789224
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1016 created 4072 1016 WerFault.exe 38 - Program crash 2 IoCs
pid pid_target Process procid_target 3412 4072 WerFault.exe 38 1016 4072 WerFault.exe 38 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 3412 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3412 WerFault.exe Token: SeBackupPrivilege 3412 WerFault.exe Token: SeDebugPrivilege 3412 WerFault.exe Token: SeDebugPrivilege 1016 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4068 wrote to memory of 4072 4068 rundll32.exe 38 PID 4068 wrote to memory of 4072 4068 rundll32.exe 38 PID 4068 wrote to memory of 4072 4068 rundll32.exe 38
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca8315a6_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca8315a6_by_Libranalysis.dll,#12⤵PID:4072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
-