c382d2d33c7036ac95058ef7ab3305b3234394428c28786d8c35f4a049047653

Analysis

Target

winlog.exe
Size

441KB
MD5

206fa6f9e31c508d79a4677d679730f2
SHA1

222ddef076c12e0a141c1f4dbf0190a9bab5b811
SHA256

c382d2d33c7036ac95058ef7ab3305b3234394428c28786d8c35f4a049047653
SHA512

b067802014dad290db64d00f2a900b57789c71b78755dd73a855a081625488640d1390b319f9d3e19f09a2ca0cb252e19e61c33a384f482ad567e0a6a5251e37

Score

7^/10

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

winlog.exerundll32.exe

description	pid	process	target process
PID 1496 wrote to memory of 652	1496	winlog.exe	rundll32.exe
PID 1496 wrote to memory of 652	1496	winlog.exe	rundll32.exe
PID 1496 wrote to memory of 652	1496	winlog.exe	rundll32.exe
PID 1496 wrote to memory of 652	1496	winlog.exe	rundll32.exe
PID 1496 wrote to memory of 652	1496	winlog.exe	rundll32.exe
PID 1496 wrote to memory of 652	1496	winlog.exe	rundll32.exe
PID 1496 wrote to memory of 652	1496	winlog.exe	rundll32.exe
PID 652 wrote to memory of 792	652	rundll32.exe	WerFault.exe
PID 652 wrote to memory of 792	652	rundll32.exe	WerFault.exe
PID 652 wrote to memory of 792	652	rundll32.exe	WerFault.exe
PID 652 wrote to memory of 792	652	rundll32.exe	WerFault.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

652 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

792 652 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 792 WerFault.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

792 WerFault.exe
792 WerFault.exe
792 WerFault.exe
792 WerFault.exe

pid	process
652	rundll32.exe

pid	pid_target	process	target process
792	652	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	792	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\winlog.exe
"C:\Users\Admin\AppData\Local\Temp\winlog.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Users\Admin\AppData\Local\Temp\Archery

Download Submit
C:\Users\Admin\AppData\Local\Temp\Subclimax.DLL

Download Submit
\Users\Admin\AppData\Local\Temp\Subclimax.dll

Download Submit
memory/652-0-0x0000000000000000-mapping.dmp

Download
memory/652-6-0x0000000000000000-mapping.dmp

Download
memory/792-4-0x0000000000000000-mapping.dmp

Download
memory/792-5-0x0000000001E60000-0x0000000001E71000-memory.dmp

Filesize
68KB

Download
memory/792-7-0x0000000002610000-0x0000000002621000-memory.dmp

Filesize
68KB

Download