Analysis
- max time kernel
44s - max time network
54s - platform
windows10_x64 - resource
win10v20210408 - submitted
21/05/2021, 05:45
Static task
static1
Behavioral task
behavioral1
Sample
2bf3e38e_by_Libranalysis.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2bf3e38e_by_Libranalysis.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 2bf3e38e_by_Libranalysis.dll
- Size 162KB
- Sample210521-eph43mnsps
- SHA256 419b2cbccbfd184f99a246a7e2c963748fac74da528a23760132f90c6e6fdc81
- MD5 2bf3e38ea01f7b4e35482c56d50b827a
- SHA1 d9d956086e5fa067fd55995aaff2b27a3a31ad83
- SHA512 546a043fe0c230f25b27f7b97e634c0660ba0d351867d627496746f3816cccf89926b97428d4044c4cca65a3a42816c3e177041457d18d3b543ec7f308dc04b8
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2416 created 1276 2416 WerFault.exe 70 - Program crash 2 IoCs
pid pid_target Process procid_target 1872 1276 WerFault.exe 70 2416 1276 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1872 WerFault.exe Token: SeBackupPrivilege 1872 WerFault.exe Token: SeDebugPrivilege 1872 WerFault.exe Token: SeDebugPrivilege 2416 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1000 wrote to memory of 1276 1000 rundll32.exe 70 PID 1000 wrote to memory of 1276 1000 rundll32.exe 70 PID 1000 wrote to memory of 1276 1000 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2bf3e38e_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2bf3e38e_by_Libranalysis.dll,#12⤵PID:1276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 6203⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 6123⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-