Analysis
- max time kernel
121s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
18/11/2021, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
ae5951e826faa8eed7f17a8efd17a6d9.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ae5951e826faa8eed7f17a8efd17a6d9.dll
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
- Target ae5951e826faa8eed7f17a8efd17a6d9.dll
- Size 474KB
- Sample211118-z4fftsfffl
- SHA256 a2eaa2c1a6efa7ae8a3423e4eb2be9dbfd5e1e9fbe30a5434c2612690695b159
- MD5 ae5951e826faa8eed7f17a8efd17a6d9
- SHA1 3e4d8d57c56c8facc4b70c2308b98bbc308504dd
- SHA512 061c477859a966658ad8de6bb2f607f33c222f92e4fa7ba2436369623a41e04fb0ef03cdcfd14fb915b2e0aa3b627439671bde550a3e34481c6c1c33477920ad
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3708 created 2572 3708 WerFault.exe 68 - Program crash 2 IoCs
pid pid_target Process procid_target 2872 2572 WerFault.exe 68 3708 2572 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe 3708 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2872 WerFault.exe Token: SeBackupPrivilege 2872 WerFault.exe Token: SeDebugPrivilege 2872 WerFault.exe Token: SeDebugPrivilege 3708 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2572 2368 rundll32.exe 68 PID 2368 wrote to memory of 2572 2368 rundll32.exe 68 PID 2368 wrote to memory of 2572 2368 rundll32.exe 68
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ae5951e826faa8eed7f17a8efd17a6d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ae5951e826faa8eed7f17a8efd17a6d9.dll,#12⤵PID:2572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 6323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-