46ceaed6d9f20fc2b5d51a63957ea0a5772f33ac4d58b1024cce8eb1c207567e

Analysis

Target

div.exe
Size

440KB
MD5

de518f9008a3b9822d1b2997f10c255d
SHA1

4ed0462686cf11774eefb80d1c9aa42c9b1341a6
SHA256

46ceaed6d9f20fc2b5d51a63957ea0a5772f33ac4d58b1024cce8eb1c207567e
SHA512

27ef460038d3c27ee09399e07f18a7f7f5ed3fe7c107154828c312d75aba3e90b3f60bfd228c239a865dd36389239355a77a6b314bf16d58556079a675a7bd0d

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1752 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1608 1752 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1608 WerFault.exe
1608 WerFault.exe
1608 WerFault.exe
1608 WerFault.exe
1608 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1608 WerFault.exe

pid	process
1752	rundll32.exe

pid	pid_target	process	target process
1608	1752	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1608	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

div.exerundll32.exe

description	pid	process	target process
PID 1684 wrote to memory of 1752	1684	div.exe	rundll32.exe
PID 1684 wrote to memory of 1752	1684	div.exe	rundll32.exe
PID 1684 wrote to memory of 1752	1684	div.exe	rundll32.exe
PID 1684 wrote to memory of 1752	1684	div.exe	rundll32.exe
PID 1684 wrote to memory of 1752	1684	div.exe	rundll32.exe
PID 1684 wrote to memory of 1752	1684	div.exe	rundll32.exe
PID 1684 wrote to memory of 1752	1684	div.exe	rundll32.exe
PID 1752 wrote to memory of 1608	1752	rundll32.exe	WerFault.exe
PID 1752 wrote to memory of 1608	1752	rundll32.exe	WerFault.exe
PID 1752 wrote to memory of 1608	1752	rundll32.exe	WerFault.exe
PID 1752 wrote to memory of 1608	1752	rundll32.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\div.exe
"C:\Users\Admin\AppData\Local\Temp\div.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\CuminFettucine.DLL

Download Submit
C:\Users\Admin\AppData\Local\Temp\Influenza

Download Submit
\Users\Admin\AppData\Local\Temp\CuminFettucine.dll

Download Submit
memory/1608-4-0x0000000000000000-mapping.dmp

Download
memory/1608-5-0x0000000001E80000-0x0000000001E91000-memory.dmp

Filesize
68KB

Download
memory/1608-7-0x0000000002610000-0x0000000002621000-memory.dmp

Filesize
68KB

Download
memory/1752-0-0x0000000000000000-mapping.dmp

Download
memory/1752-6-0x0000000000000000-mapping.dmp

Download