c43ac92a424c154cc3dfa3a7558dc3040ed5feedd24a89471b93fbe8f27bf66b

Analysis

Target

SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll
Size

532KB
MD5

d0f8531ec645191396671e3f832bb498
SHA1

9e02272de43ecdafd4fe3b993acceaefb403f473
SHA256

c43ac92a424c154cc3dfa3a7558dc3040ed5feedd24a89471b93fbe8f27bf66b
SHA512

bc515302aa9a48429f984e89392c34489944a49e84fecd0dab31fb4a5a968583728a949d24375c493d357ce5f66cb12ae9be209742ff8ecc462756048a98ec49

Score

3^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 3048	3608	rundll32.exe	67
PID 3608 wrote to memory of 3048	3608	rundll32.exe	67
PID 3608 wrote to memory of 3048	3608	rundll32.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3932	3048	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll,#1
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 616
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3932

memory/3932-1-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/3932-4-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download