24422cb0f7d728cc09141faf58798e307952657f3624ea11b7cae6e743d56fd6

Analysis

Target

adobe_hex.dll
Size

157KB
MD5

9268cf2adae7afe71d418e6c31022884
SHA1

53f0cc2a9029074843f8ed69ba7e54b68864bb25
SHA256

24422cb0f7d728cc09141faf58798e307952657f3624ea11b7cae6e743d56fd6
SHA512

3f524cf5264a31b9f35575060c47e1cce33f4f07fba6136180696a29028cb4adb1333895982b9be995f2903b5ff500298d67ccde908451c1817c752ef9a07e96

Score

3^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1512 wrote to memory of 272	1512	rundll32.exe	25
PID 1512 wrote to memory of 272	1512	rundll32.exe	25
PID 1512 wrote to memory of 272	1512	rundll32.exe	25
PID 1512 wrote to memory of 272	1512	rundll32.exe	25

Program crash 1 IoCs

pid	pid_target	Process	procid_target
272	1512	WerFault.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	272	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adobe_hex.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adobe_hex.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 224
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:272

memory/272-2-0x0000000002230000-0x0000000002241000-memory.dmp

Filesize
68KB

Download
memory/272-4-0x0000000002500000-0x0000000002511000-memory.dmp

Filesize
68KB

Download