d06d675add136cc82c55c68166df534afa018e9f1ae333a9a75cacc1ec66d9d3

Analysis

Target

SecuriteInfo.com.Trojan.GenericKD.42681420.1031.32076.dll
Size

442KB
MD5

1bca22547678b00aa2227b45cfeec4fd
SHA1

bbd3a4ce33ccb450dbc6516e88791c7e82b526c4
SHA256

d06d675add136cc82c55c68166df534afa018e9f1ae333a9a75cacc1ec66d9d3
SHA512

09dc8f05050dba937bf0c8b45348ba503977876389a1e65880890a2f348886366b172bf6f67dfa874071d96ef9727781fc2b6d02d7ad8d8ba154a6b0d7dee48a

Score

3^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3208	3544	rundll32.exe	66
PID 3544 wrote to memory of 3208	3544	rundll32.exe	66
PID 3544 wrote to memory of 3208	3544	rundll32.exe	66

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	3208	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.42681420.1031.32076.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.42681420.1031.32076.dll,#1
  2⤵
  PID:3208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 828
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:640

memory/640-1-0x00000000043B0000-0x00000000043B1000-memory.dmp

Filesize
4KB

Download
memory/640-5-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download