929ebb7e7982c89438ccbb2f9b78ed4db55ebecbddbcd2840dbaa40dad8cd4d7

Analysis

Target

SecuriteInfo.com.Variant.Johnnie.216272.10326.13253.dll
Size

709KB
MD5

02439ec87ee475dd466f815bc5150ed5
SHA1

ffbb96caab03d5b6c35bdb01b664ebee53bb2538
SHA256

929ebb7e7982c89438ccbb2f9b78ed4db55ebecbddbcd2840dbaa40dad8cd4d7
SHA512

ff2c16ef29731db00463816937d6633ca91736d3aa01005afd6158c7bdda2ac3038560d3c53f5aa1dcbd5c72d270d0ab0f4c744f7b5906635aa8fa5a8ac02ed6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	3720	WerFault.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3720	1616	rundll32.exe	68
PID 1616 wrote to memory of 3720	1616	rundll32.exe	68
PID 1616 wrote to memory of 3720	1616	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.10326.13253.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.10326.13253.dll,#1
  2⤵
  PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 616
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1788

memory/1788-1-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/1788-2-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/1788-5-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download