0bc832f900a1206f3d52cfd3535dcb0565ae63dc46f4d666430a016464b1190a

Analysis

Target

74cfa252e69c230f4d698eb2fd781b3b7c17231b1f4afccfcc23ffa5d3b2f467_3.dll
Size

223KB
MD5

699e7ecc8e3dc2b6d3e10adbedc6ae81
SHA1

f1de00fd127ef7b1128b60b1cfc0d43d01cb3b47
SHA256

0bc832f900a1206f3d52cfd3535dcb0565ae63dc46f4d666430a016464b1190a
SHA512

3047f855e083e61dab27a715a995380cf8c3501a7f6bb110b726a7603c2737d6631d245fad8e1acfd1839e57098bc435a63e2379973c9c9abe5bdd686190531e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	2144	WerFault.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74cfa252e69c230f4d698eb2fd781b3b7c17231b1f4afccfcc23ffa5d3b2f467_3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74cfa252e69c230f4d698eb2fd781b3b7c17231b1f4afccfcc23ffa5d3b2f467_3.dll,#1
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 620
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:2960

memory/2960-1-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/2960-2-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/2960-5-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download