1cfe86d814bdcea1349fbab577a647cde75e23d4eaa8c1b763c04a7491ed736e

Analysis

Target

3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7_3.dll
Size

236KB
MD5

bbfe1c0f8861d941f06bcda4f98513d7
SHA1

cea93360ba52b90d53f7d8cc4428cea9f8af413f
SHA256

1cfe86d814bdcea1349fbab577a647cde75e23d4eaa8c1b763c04a7491ed736e
SHA512

8dc80a80957e8aca3ee1a516944ca127328753cc04b7681636766a9f52e72c64556e43c27680f7094b439402a44d29fa0788bfc3fc4f5798d00a48fa8037188c

Score

3^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 744	1588	rundll32.exe	24
PID 1588 wrote to memory of 744	1588	rundll32.exe	24
PID 1588 wrote to memory of 744	1588	rundll32.exe	24
PID 1588 wrote to memory of 744	1588	rundll32.exe	24
PID 1588 wrote to memory of 744	1588	rundll32.exe	24
PID 1588 wrote to memory of 744	1588	rundll32.exe	24
PID 1588 wrote to memory of 744	1588	rundll32.exe	24
PID 744 wrote to memory of 1604	744	rundll32.exe	25
PID 744 wrote to memory of 1604	744	rundll32.exe	25
PID 744 wrote to memory of 1604	744	rundll32.exe	25
PID 744 wrote to memory of 1604	744	rundll32.exe	25

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	744	WerFault.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7_3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7_3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 224
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1604

memory/1604-2-0x0000000001ED0000-0x0000000001EE1000-memory.dmp

Filesize
68KB

Download
memory/1604-4-0x00000000024E0000-0x00000000024F1000-memory.dmp

Filesize
68KB

Download