Analysis
- max time kernel
21s - max time network
110s - platform
windows10_x64 - resource
win10v20210410 - submitted
17/05/2021, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
2df04911_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2df04911_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 2df04911_by_Libranalysis.dll
- Size 162KB
- Sample210517-ecd51n2cts
- SHA256 aa202eba02650084d1cfcc09f62293c1108552cfacef8a769f8a4402eb3c8e79
- MD5 2df049115dfb251c81776ef873f8abba
- SHA1 91edef862b26770ea3cd9b9faa65532398b589da
- SHA512 becda53993a9ce95a932b80c0c5ff53b5adfe6c3ce6aa86f485ef0140ec10590b1514e39f4157f322099bb339207d2e331086d053f124f0d294a034d245f862c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1264 created 1908 1264 WerFault.exe 29 - Program crash 2 IoCs
pid pid_target Process procid_target 3556 1908 WerFault.exe 29 1264 1908 WerFault.exe 29 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3556 WerFault.exe Token: SeBackupPrivilege 3556 WerFault.exe Token: SeDebugPrivilege 3556 WerFault.exe Token: SeDebugPrivilege 1264 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3224 wrote to memory of 1908 3224 rundll32.exe 29 PID 3224 wrote to memory of 1908 3224 rundll32.exe 29 PID 3224 wrote to memory of 1908 3224 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2df04911_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2df04911_by_Libranalysis.dll,#12⤵PID:1908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 6083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-