Analysis
- max time kernel
112s - max time network
127s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
18/11/2021, 23:53
Static task
static1
Behavioral task
behavioral1
Sample
5396135926f3d561823702e15191897a.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5396135926f3d561823702e15191897a.dll
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target 5396135926f3d561823702e15191897a.dll
- Size 474KB
- Sample211118-3xatjsbch4
- SHA256 ac0c7a80d4eaf440526bd4b902e31bac13c09c94ca946dbd5591fd7c09d668f2
- MD5 5396135926f3d561823702e15191897a
- SHA1 d69e5939a0fdac94d31fb7c782727e9e8bced2a0
- SHA512 a5fc21c55600a1d34298eccad34d91b6591c451d1d5476c3167874feebe6f2e600024b561069355c0b33c33eeaafa7712f6164433f088ac89a2ce1c8b82c4566
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1116 created 3592 1116 WerFault.exe 69 - Program crash 2 IoCs
pid pid_target Process procid_target 700 3592 WerFault.exe 69 1116 3592 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 700 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 700 WerFault.exe Token: SeBackupPrivilege 700 WerFault.exe Token: SeDebugPrivilege 700 WerFault.exe Token: SeDebugPrivilege 1116 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2764 wrote to memory of 3592 2764 rundll32.exe 69 PID 2764 wrote to memory of 3592 2764 rundll32.exe 69 PID 2764 wrote to memory of 3592 2764 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5396135926f3d561823702e15191897a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5396135926f3d561823702e15191897a.dll,#12⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 6083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-