Analysis
- max time kernel
110s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
25/11/2021, 04:10
Static task
static1
Behavioral task
behavioral1
Sample
15239e7be7ce6bfaf0681eb66bcde356.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
15239e7be7ce6bfaf0681eb66bcde356.dll
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target 15239e7be7ce6bfaf0681eb66bcde356.dll
- Size 470KB
- Sample211125-erecsaecbk
- SHA256 79036368e6229fa1c4eb724a34e4d10973feaa85628058f4ac1eaac6c1fcf19c
- MD5 15239e7be7ce6bfaf0681eb66bcde356
- SHA1 55dc2a27f408bf6437224ecfc62cc01a3311ec08
- SHA512 366168368edc0dae19f071431deb1b5a8a9141179ebf84623e8053a00915dc69ec941273658a6c2a94f897f2fc053767774a310ccf4964d3e37d545ab1ad93fa
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4528 created 2864 4528 WerFault.exe 68 - Program crash 2 IoCs
pid pid_target Process procid_target 4616 2864 WerFault.exe 68 4528 2864 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4616 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe 4528 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 4616 WerFault.exe Token: SeBackupPrivilege 4616 WerFault.exe Token: SeDebugPrivilege 4616 WerFault.exe Token: SeDebugPrivilege 4528 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4392 wrote to memory of 2864 4392 rundll32.exe 68 PID 4392 wrote to memory of 2864 4392 rundll32.exe 68 PID 4392 wrote to memory of 2864 4392 rundll32.exe 68
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15239e7be7ce6bfaf0681eb66bcde356.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15239e7be7ce6bfaf0681eb66bcde356.dll,#12⤵PID:2864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 6083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-