8a07c265a20279d4b60da2cc26f2bb041730c90c6d3eca64a8dd9f4a032d85d3

General

Target

acrord32.dll
Size

364KB
MD5

6060f7dc35c4d43728d5ca5286327c01
SHA1

35ff54838cb6db9a1829d110d2a6b47001648f17
SHA256

8a07c265a20279d4b60da2cc26f2bb041730c90c6d3eca64a8dd9f4a032d85d3
SHA512

4898e9afb3858fa1f3eb493ea4d6eb6b3f9701aafceb7ed70aa71ec170fc06530bcbe6e1058547e0473d40630fa85484a37a9aadd143e575144948764ba089b3

Score

8^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1932 WerFault.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1932 WerFault.exe
1932 WerFault.exe
1932 WerFault.exe
1932 WerFault.exe
1932 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1060 AcroRd32.exe

description	pid	process
Token: SeDebugPrivilege	1932	WerFault.exe

pid	process
1060	AcroRd32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 740 wrote to memory of 1116	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1116	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1116	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1116	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1116	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1116	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1116	740	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1060	1116	rundll32.exe	AcroRd32.exe
PID 1116 wrote to memory of 1060	1116	rundll32.exe	AcroRd32.exe
PID 1116 wrote to memory of 1060	1116	rundll32.exe	AcroRd32.exe
PID 1116 wrote to memory of 1060	1116	rundll32.exe	AcroRd32.exe
PID 1116 wrote to memory of 1932	1116	rundll32.exe	WerFault.exe
PID 1116 wrote to memory of 1932	1116	rundll32.exe	WerFault.exe
PID 1116 wrote to memory of 1932	1116	rundll32.exe	WerFault.exe
PID 1116 wrote to memory of 1932	1116	rundll32.exe	WerFault.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1060 AcroRd32.exe
1060 AcroRd32.exe
1060 AcroRd32.exe
Blacklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

4 1116 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1932 1116 WerFault.exe rundll32.exe

flow	pid	process
4	1116	rundll32.exe

pid	pid_target	process	target process
1932	1116	WerFault.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acrord32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Local\Temp\DOC-2020-05-15T092742.441.pdf

Download Submit
memory/1060-1-0x0000000000000000-mapping.dmp

Download
memory/1116-12-0x0000000000000000-mapping.dmp

Download
memory/1116-9-0x0000000000000000-mapping.dmp

Download
memory/1116-15-0x0000000000000000-mapping.dmp

Download
memory/1116-5-0x0000000000000000-mapping.dmp

Download
memory/1116-6-0x0000000000000000-mapping.dmp

Download
memory/1116-7-0x0000000000000000-mapping.dmp

Download
memory/1116-8-0x0000000000000000-mapping.dmp

Download
memory/1116-14-0x0000000000000000-mapping.dmp

Download
memory/1116-10-0x0000000000000000-mapping.dmp

Download
memory/1116-11-0x0000000000000000-mapping.dmp

Download
memory/1116-0-0x0000000000000000-mapping.dmp

Download
memory/1116-13-0x0000000000000000-mapping.dmp

Download
memory/1932-3-0x0000000000000000-mapping.dmp

Download
memory/1932-4-0x00000000021B0000-0x00000000021C1000-memory.dmp

Filesize
68KB

Download
memory/1932-16-0x0000000002840000-0x0000000002851000-memory.dmp

Filesize
68KB

Download