Analysis
- max time kernel
110s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
26/11/2021, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
besta.ocx.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
besta.ocx.dll
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target besta.ocx.dll
- Size 474KB
- Sample211126-pxb5qaccfl
- SHA256 f87c4159b834be6f1c21dfd320ea7238bb278657352a014dc4092c7a11dd7bec
- MD5 4ae29f15b773cc32a8a58e2b1a09bce5
- SHA1 da47fb50eff4d829024fddce614c42cfcc56bde2
- SHA512 8f3e959726605801ca34c8b6e495fb3f9db6dc969e2422b99b5d3b6ddab328422dd4c1aeab4fb72b67aa991891031a70c835e41259e5ce2f4b27eee181dd094c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1112 created 2212 1112 WerFault.exe 68 - Program crash 2 IoCs
pid pid_target Process procid_target 2216 2212 WerFault.exe 68 1112 2212 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2216 WerFault.exe Token: SeBackupPrivilege 2216 WerFault.exe Token: SeDebugPrivilege 2216 WerFault.exe Token: SeDebugPrivilege 1112 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3792 wrote to memory of 2212 3792 rundll32.exe 68 PID 3792 wrote to memory of 2212 3792 rundll32.exe 68 PID 3792 wrote to memory of 2212 3792 rundll32.exe 68
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll,#12⤵PID:2212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-