929ebb7e7982c89438ccbb2f9b78ed4db55ebecbddbcd2840dbaa40dad8cd4d7

Analysis

Target

SecuriteInfo.com.Variant.Johnnie.216272.10326.13253.dll
Size

709KB
MD5

02439ec87ee475dd466f815bc5150ed5
SHA1

ffbb96caab03d5b6c35bdb01b664ebee53bb2538
SHA256

929ebb7e7982c89438ccbb2f9b78ed4db55ebecbddbcd2840dbaa40dad8cd4d7
SHA512

ff2c16ef29731db00463816937d6633ca91736d3aa01005afd6158c7bdda2ac3038560d3c53f5aa1dcbd5c72d270d0ab0f4c744f7b5906635aa8fa5a8ac02ed6

Score

3^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 364	1612	rundll32.exe	24
PID 1612 wrote to memory of 364	1612	rundll32.exe	24
PID 1612 wrote to memory of 364	1612	rundll32.exe	24
PID 1612 wrote to memory of 364	1612	rundll32.exe	24
PID 1612 wrote to memory of 364	1612	rundll32.exe	24
PID 1612 wrote to memory of 364	1612	rundll32.exe	24
PID 1612 wrote to memory of 364	1612	rundll32.exe	24
PID 364 wrote to memory of 1076	364	rundll32.exe	25
PID 364 wrote to memory of 1076	364	rundll32.exe	25
PID 364 wrote to memory of 1076	364	rundll32.exe	25
PID 364 wrote to memory of 1076	364	rundll32.exe	25

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1076	364	WerFault.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.10326.13253.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.10326.13253.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 224
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1076

memory/1076-2-0x0000000001F60000-0x0000000001F71000-memory.dmp

Filesize
68KB

Download
memory/1076-4-0x0000000002530000-0x0000000002541000-memory.dmp

Filesize
68KB

Download