348c1970f3ce0b20eda196db27b3596864d8e99bedf575855aa35f5b5f5fc084

Analysis

Target
3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7.dll
Size 254KB
Sample200717-53t7fxt11x
SHA256 348c1970f3ce0b20eda196db27b3596864d8e99bedf575855aa35f5b5f5fc084
MD5 4cba8d57baf9ef051ad5918e42cb0332
SHA1 6bc2499dc21937ec990bb050c11a497ecd0a6e59
SHA512 22fdd8140a506421fcdff4d7e012ebf89408619762df0dbb678ae64e669839a065e0466f02be6e715ae908d8627684369193bfd6d813dba657f0e3349a65cd61
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1720	1628	rundll32.exe	68
PID 1628 wrote to memory of 1720	1628	rundll32.exe	68
PID 1628 wrote to memory of 1720	1628	rundll32.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	1720	WerFault.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7.dll,#1
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 616
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1372

memory/1372-1-0x0000000004490000-0x0000000004491000-memory.dmp

Download

memory/1372-5-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download