d85fc0e45cc705cc7052e05fe23b2ed7a18dc13de509ad49509e090465b01230

Analysis

Target
temp.tmp.dll
Size 130KB
Sample200827-j4gty8ppvs
SHA256 d85fc0e45cc705cc7052e05fe23b2ed7a18dc13de509ad49509e090465b01230
MD5 909d4faaa4cd504c55b374410603d682
SHA1 f386f28b3f7496457f233a76c6f91026e2ffc9f0
SHA512 8decab67dacd7d6d191b5b647459a3ac436e7b263c098ad7438557d9e3297b02f6253b029962a77c50c7423a4ac80c295149ce323850ebbc1e070e5dc9e54b76
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	1568	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1568	1124	rundll32.exe	25
PID 1124 wrote to memory of 1568	1124	rundll32.exe	25
PID 1124 wrote to memory of 1568	1124	rundll32.exe	25
PID 1124 wrote to memory of 1568	1124	rundll32.exe	25
PID 1124 wrote to memory of 1568	1124	rundll32.exe	25
PID 1124 wrote to memory of 1568	1124	rundll32.exe	25
PID 1124 wrote to memory of 1568	1124	rundll32.exe	25
PID 1568 wrote to memory of 1620	1568	rundll32.exe	26
PID 1568 wrote to memory of 1620	1568	rundll32.exe	26
PID 1568 wrote to memory of 1620	1568	rundll32.exe	26
PID 1568 wrote to memory of 1620	1568	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 224
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1620

memory/1620-2-0x0000000002130000-0x0000000002141000-memory.dmp

Download

memory/1620-4-0x0000000002550000-0x0000000002561000-memory.dmp

Download