1cfe86d814bdcea1349fbab577a647cde75e23d4eaa8c1b763c04a7491ed736e

Analysis

Target

3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7_3.dll
Size

236KB
MD5

bbfe1c0f8861d941f06bcda4f98513d7
SHA1

cea93360ba52b90d53f7d8cc4428cea9f8af413f
SHA256

1cfe86d814bdcea1349fbab577a647cde75e23d4eaa8c1b763c04a7491ed736e
SHA512

8dc80a80957e8aca3ee1a516944ca127328753cc04b7681636766a9f52e72c64556e43c27680f7094b439402a44d29fa0788bfc3fc4f5798d00a48fa8037188c

Score

3^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3892	2564	rundll32.exe	66
PID 2564 wrote to memory of 3892	2564	rundll32.exe	66
PID 2564 wrote to memory of 3892	2564	rundll32.exe	66

Program crash 1 IoCs

pid	pid_target	Process	procid_target
516	3892	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7_3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2b01f3d6da5dd4a9b1e05d7b56a3e67158cb3310495985c0b9c8d41ca9b5e7_3.dll,#1
  2⤵
  PID:3892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 616
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:516

memory/516-1-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/516-4-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download