348c1970f3ce0b20eda196db27b3596864d8e99bedf575855aa35f5b5f5fc084

Analysis

Target
3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7.dll
Size 254KB
Sample200717-53t7fxt11x
SHA256 348c1970f3ce0b20eda196db27b3596864d8e99bedf575855aa35f5b5f5fc084
MD5 4cba8d57baf9ef051ad5918e42cb0332
SHA1 6bc2499dc21937ec990bb050c11a497ecd0a6e59
SHA512 22fdd8140a506421fcdff4d7e012ebf89408619762df0dbb678ae64e669839a065e0466f02be6e715ae908d8627684369193bfd6d813dba657f0e3349a65cd61
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1300	616	rundll32.exe	24
PID 616 wrote to memory of 1300	616	rundll32.exe	24
PID 616 wrote to memory of 1300	616	rundll32.exe	24
PID 616 wrote to memory of 1300	616	rundll32.exe	24
PID 616 wrote to memory of 1300	616	rundll32.exe	24
PID 616 wrote to memory of 1300	616	rundll32.exe	24
PID 616 wrote to memory of 1300	616	rundll32.exe	24
PID 1300 wrote to memory of 1412	1300	rundll32.exe	25
PID 1300 wrote to memory of 1412	1300	rundll32.exe	25
PID 1300 wrote to memory of 1412	1300	rundll32.exe	25
PID 1300 wrote to memory of 1412	1300	rundll32.exe	25

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1412	1300	WerFault.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 224
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1412

memory/1412-2-0x0000000002240000-0x0000000002251000-memory.dmp

Download

memory/1412-4-0x00000000025D0000-0x00000000025E1000-memory.dmp

Download