24422cb0f7d728cc09141faf58798e307952657f3624ea11b7cae6e743d56fd6

Analysis

Target

adobe_hex.dll
Size

157KB
MD5

9268cf2adae7afe71d418e6c31022884
SHA1

53f0cc2a9029074843f8ed69ba7e54b68864bb25
SHA256

24422cb0f7d728cc09141faf58798e307952657f3624ea11b7cae6e743d56fd6
SHA512

3f524cf5264a31b9f35575060c47e1cce33f4f07fba6136180696a29028cb4adb1333895982b9be995f2903b5ff500298d67ccde908451c1817c752ef9a07e96

Score

3^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3892	2564	rundll32.exe	66
PID 2564 wrote to memory of 3892	2564	rundll32.exe	66
PID 2564 wrote to memory of 3892	2564	rundll32.exe	66

Program crash 1 IoCs

pid	pid_target	Process	procid_target
516	3892	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adobe_hex.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adobe_hex.dll,#1
  2⤵
  PID:3892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 616
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:516

memory/516-1-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/516-4-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download