c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2

Analysis

Target

SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll
Size

723KB
MD5

22c1b894002c6ffd1fdc2a75b48ddcda
SHA1

5037543f108882d6a0d5b1907d125d40e4126e32
SHA256

c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2
SHA512

67fe107a5bf13fa041eed46c4477ced5fd1af826cd6fc7e5b0661f3690d1a1eeeb69973ef9ccb50c13bc38740711ad0070daaa4b23ef49c9f28c164a881c4a67

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	3840	WerFault.exe	67

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 8f0027c5b17cd601	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3584	svchost.exe
Token: SeCreatePagefilePrivilege	3584	svchost.exe
Token: SeRestorePrivilege	3860	WerFault.exe
Token: SeBackupPrivilege	3860	WerFault.exe
Token: SeDebugPrivilege	3860	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 3840	720	rundll32.exe	67
PID 720 wrote to memory of 3840	720	rundll32.exe	67
PID 720 wrote to memory of 3840	720	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll,#1
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 604
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3860

memory/3860-1-0x0000000004650000-0x0000000004651000-memory.dmp

Filesize
4KB

Download
memory/3860-4-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download