0b5a7876121672a2ad042ba26d57e186b6f1c9b07daa32c2fe4864c56c2e9c4f

Analysis

Target
SecuriteInfo.com.Mal.EncPk-APV.27854.18614.dll
Size 333KB
Sample200715-4lmxmkzz7n
SHA256 0b5a7876121672a2ad042ba26d57e186b6f1c9b07daa32c2fe4864c56c2e9c4f
MD5 d5598add4a960ea5a82f49607f76b679
SHA1 7ee99fd1cea9527d0f097989a92b866bd2d5a6d2
SHA512 cf8ae261802212917aa6bbff679329f8fc45e2154edc8626cc365f4b2c1d5751472e884d60247bbf133110a5b19fea044bb2260f51f1d4c1bdd4c86ac6db19cb
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 812	2804	rundll32.exe	66
PID 2804 wrote to memory of 812	2804	rundll32.exe	66
PID 2804 wrote to memory of 812	2804	rundll32.exe	66

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	812	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 14 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.EncPk-APV.27854.18614.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.EncPk-APV.27854.18614.dll,#1
  2⤵
  PID:812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 616
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1684

memory/1684-1-0x00000000045E0000-0x00000000045E1000-memory.dmp

Download

memory/1684-4-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download