1f4c6010859130ce9df006aa169ce1840624de8da5fee845f209c2a7d6b606a8

General

Target

acrord32.dll
Size

360KB
MD5

f888bb77af9018a617b8a74d739ac29f
SHA1

68f9fc2139713cd3913a443f67f24f8ce028c8d2
SHA256

1f4c6010859130ce9df006aa169ce1840624de8da5fee845f209c2a7d6b606a8
SHA512

c71fb42538ee406c3834f73fb664cd7f8213ef4a0df66c2380a1b70f5ef2a76399ca3835fea1105b1c20fa8f1a717b358fec0cb755a99a34c7e9d086145bce81

Score

8^/10

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1520 wrote to memory of 836	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 836	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 836	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 836	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 836	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 836	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 836	1520	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1596	836	rundll32.exe	AcroRd32.exe
PID 836 wrote to memory of 1596	836	rundll32.exe	AcroRd32.exe
PID 836 wrote to memory of 1596	836	rundll32.exe	AcroRd32.exe
PID 836 wrote to memory of 1596	836	rundll32.exe	AcroRd32.exe
PID 836 wrote to memory of 1836	836	rundll32.exe	WerFault.exe
PID 836 wrote to memory of 1836	836	rundll32.exe	WerFault.exe
PID 836 wrote to memory of 1836	836	rundll32.exe	WerFault.exe
PID 836 wrote to memory of 1836	836	rundll32.exe	WerFault.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1596 AcroRd32.exe
1596 AcroRd32.exe
1596 AcroRd32.exe
Blacklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

3 836 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1836 836 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1836 WerFault.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1836 WerFault.exe
1836 WerFault.exe
1836 WerFault.exe
1836 WerFault.exe
1836 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1596 AcroRd32.exe

flow	pid	process
3	836	rundll32.exe

pid	pid_target	process	target process
1836	836	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1836	WerFault.exe

pid	process
1596	AcroRd32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acrord32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\AppData\Local\Temp\DOC000(54).pdf

Download Submit
memory/836-9-0x0000000000000000-mapping.dmp

Download
memory/836-8-0x0000000000000000-mapping.dmp

Download
memory/836-13-0x0000000000000000-mapping.dmp

Download
memory/836-12-0x0000000000000000-mapping.dmp

Download
memory/836-5-0x0000000000000000-mapping.dmp

Download
memory/836-6-0x0000000000000000-mapping.dmp

Download
memory/836-7-0x0000000000000000-mapping.dmp

Download
memory/836-11-0x0000000000000000-mapping.dmp

Download
memory/836-0-0x0000000000000000-mapping.dmp

Download
memory/836-10-0x0000000000000000-mapping.dmp

Download
memory/1596-1-0x0000000000000000-mapping.dmp

Download
memory/1836-4-0x00000000022F0000-0x0000000002301000-memory.dmp

Filesize
68KB

Download
memory/1836-3-0x0000000000000000-mapping.dmp

Download
memory/1836-14-0x00000000029C0000-0x00000000029D1000-memory.dmp

Filesize
68KB

Download