Analysis
- max time kernel
123s - max time network
125s - platform
windows10_x64 - resource
win10v20210410 - submitted
15/05/2021, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
3a1d61f9_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3a1d61f9_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 3a1d61f9_by_Libranalysis.dll
- Size 162KB
- Sample210515-k2b4ep1792
- SHA256 8a26705ffb571985fb84b04f4b5b095763459fcaf6e76ae32eec367f6fda9c2a
- MD5 3a1d61f9ebe7bacb1cf6477e7742d4de
- SHA1 374a67d77d80d938f8c2f77f51974f51f36c89ca
- SHA512 348fb9b88979282681ecc35d0b091b47adc9028239de613d335dff3d0e1ccde7b565de7c33781ccb52bbab989833a61e214c88cebabc03da3381be715656c74e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2664 created 3056 2664 WerFault.exe 28 - Program crash 2 IoCs
pid pid_target Process procid_target 2540 3056 WerFault.exe 28 2664 3056 WerFault.exe 28 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2540 WerFault.exe Token: SeBackupPrivilege 2540 WerFault.exe Token: SeDebugPrivilege 2540 WerFault.exe Token: SeDebugPrivilege 2664 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4040 wrote to memory of 3056 4040 rundll32.exe 28 PID 4040 wrote to memory of 3056 4040 rundll32.exe 28 PID 4040 wrote to memory of 3056 4040 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1d61f9_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1d61f9_by_Libranalysis.dll,#12⤵PID:3056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6403⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-