Analysis
- max time kernel
120s - max time network
121s - platform
windows10_x64 - resource
win10v20210410 - submitted
14/05/2021, 20:03
Static task
static1
Behavioral task
behavioral1
Sample
606d0173_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
606d0173_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 606d0173_by_Libranalysis.dll
- Size 162KB
- Sample210514-6rmrgvmars
- SHA256 7162c617fb3b033f93750d936f3722b205e4fdd5ebfb0e641708edc91bfb451b
- MD5 606d0173498faf13c30b12201067cf5b
- SHA1 31cddb4b559dbcefeba6a748ce26c8afe225b751
- SHA512 745dbe14860df523e6e5a21b9316c4311554d1239201fa0042d3bc09d8b6b255275752d6a11a364b9d5313324edb29b1fdf2d75f45c69dc039a8359f82f98913
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3812 created 3184 3812 WerFault.exe 72 - Program crash 2 IoCs
pid pid_target Process procid_target 3616 3184 WerFault.exe 72 3812 3184 WerFault.exe 72 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3616 WerFault.exe Token: SeBackupPrivilege 3616 WerFault.exe Token: SeDebugPrivilege 3616 WerFault.exe Token: SeDebugPrivilege 3812 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3680 wrote to memory of 3184 3680 rundll32.exe 72 PID 3680 wrote to memory of 3184 3680 rundll32.exe 72 PID 3680 wrote to memory of 3184 3680 rundll32.exe 72
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\606d0173_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\606d0173_by_Libranalysis.dll,#12⤵PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 6283⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 5683⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-