c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6

Analysis

Target
goopdate.dll
Size 285KB
Sample200717-5wptmayme6
SHA256 c3dfcd55ea3b621537c1d7170212249d3d12f96a08d0e5c2ed1d4f0cf6036eb6
MD5 3bb71cef8a643cf00aef4ed04a599b12
SHA1 bf8a77be54fffaca0775b2947e29b46959c010b9
SHA512 82f48dd1f2bab3cb53f9d0127f4dc53a247e5af05a1ae7b7f6271bf1676560305df726c72bd330a387edba86714bfe45b65029720b4faeaf1a10a905fe617a9e
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1144	1068	rundll32.exe	68
PID 1068 wrote to memory of 1144	1068	rundll32.exe	68
PID 1068 wrote to memory of 1144	1068	rundll32.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	1144	WerFault.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\goopdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\goopdate.dll,#1
  2⤵
  PID:1144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 620
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1484

memory/1484-1-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/1484-4-0x0000000004F80000-0x0000000004F81000-memory.dmp

Download