Analysis
- max time kernel
80s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
18/11/2021, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
b175682158ee023a48d49fd08bfc915e.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b175682158ee023a48d49fd08bfc915e.dll
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
- Target b175682158ee023a48d49fd08bfc915e.dll
- Size 474KB
- Sample211118-z4fftsfffj
- SHA256 e2af43bcd3de5a6e98519a5e3e026b790fd4ff1c70abf006ed45594708da7eb3
- MD5 b175682158ee023a48d49fd08bfc915e
- SHA1 a1357675067b82e282d0f5e38c75aa2fe21d55a6
- SHA512 6086d99c1f1ca4774833ccdffa2f7ca425a84d19f5c0c5e8e03258e361982a518cc9e1f71ebd5bc6e98a5febce8576c780fcefc96470eb19c197db221b8d043a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3400 created 2572 3400 WerFault.exe 69 - Program crash 2 IoCs
pid pid_target Process procid_target 3968 2572 WerFault.exe 69 3400 2572 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe 3400 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3968 WerFault.exe Token: SeBackupPrivilege 3968 WerFault.exe Token: SeDebugPrivilege 3968 WerFault.exe Token: SeDebugPrivilege 3400 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3724 wrote to memory of 2572 3724 rundll32.exe 69 PID 3724 wrote to memory of 2572 3724 rundll32.exe 69 PID 3724 wrote to memory of 2572 3724 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b175682158ee023a48d49fd08bfc915e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b175682158ee023a48d49fd08bfc915e.dll,#12⤵PID:2572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 6083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-