0bc832f900a1206f3d52cfd3535dcb0565ae63dc46f4d666430a016464b1190a

Analysis

Target

74cfa252e69c230f4d698eb2fd781b3b7c17231b1f4afccfcc23ffa5d3b2f467_3.dll
Size

223KB
MD5

699e7ecc8e3dc2b6d3e10adbedc6ae81
SHA1

f1de00fd127ef7b1128b60b1cfc0d43d01cb3b47
SHA256

0bc832f900a1206f3d52cfd3535dcb0565ae63dc46f4d666430a016464b1190a
SHA512

3047f855e083e61dab27a715a995380cf8c3501a7f6bb110b726a7603c2737d6631d245fad8e1acfd1839e57098bc435a63e2379973c9c9abe5bdd686190531e

Score

3^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	272	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1448 wrote to memory of 1512	1448	rundll32.exe	24
PID 1512 wrote to memory of 272	1512	rundll32.exe	25
PID 1512 wrote to memory of 272	1512	rundll32.exe	25
PID 1512 wrote to memory of 272	1512	rundll32.exe	25
PID 1512 wrote to memory of 272	1512	rundll32.exe	25

Program crash 1 IoCs

pid	pid_target	Process	procid_target
272	1512	WerFault.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74cfa252e69c230f4d698eb2fd781b3b7c17231b1f4afccfcc23ffa5d3b2f467_3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74cfa252e69c230f4d698eb2fd781b3b7c17231b1f4afccfcc23ffa5d3b2f467_3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 224
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    PID:272

memory/272-2-0x0000000001F80000-0x0000000001F91000-memory.dmp

Filesize
68KB

Download
memory/272-4-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download