bc36c8d0ca400dd8e12f7d5af0569c24f549305697b46804fa700edf573884fb

Analysis

Target
dc475e00d9bc4e94ab1d528a5540e67d.exe
Size 371KB
Sample200909-bbjtzrcgee
SHA256 bc36c8d0ca400dd8e12f7d5af0569c24f549305697b46804fa700edf573884fb
MD5 dc475e00d9bc4e94ab1d528a5540e67d
SHA1 348dbddf7b7c0488f25afb5c8f0ec312f7813fee
SHA512 c992aa79f057e9169b259cabe3ede64fba606f7434e496cc0c910211a5f8ba0cb67784a6a14827bd67ceb3897156add1ce2a59a00cad8e9a24e24a210f118486
MD5 SHA1 SHA512

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1928	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1576	1928	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1928	540	dc475e00d9bc4e94ab1d528a5540e67d.exe	28
PID 540 wrote to memory of 1928	540	dc475e00d9bc4e94ab1d528a5540e67d.exe	28
PID 540 wrote to memory of 1928	540	dc475e00d9bc4e94ab1d528a5540e67d.exe	28
PID 540 wrote to memory of 1928	540	dc475e00d9bc4e94ab1d528a5540e67d.exe	28
PID 540 wrote to memory of 1928	540	dc475e00d9bc4e94ab1d528a5540e67d.exe	28
PID 540 wrote to memory of 1928	540	dc475e00d9bc4e94ab1d528a5540e67d.exe	28
PID 540 wrote to memory of 1928	540	dc475e00d9bc4e94ab1d528a5540e67d.exe	28
PID 1928 wrote to memory of 1576	1928	rundll32.exe	29
PID 1928 wrote to memory of 1576	1928	rundll32.exe	29
PID 1928 wrote to memory of 1576	1928	rundll32.exe	29
PID 1928 wrote to memory of 1576	1928	rundll32.exe	29

C:\Users\Admin\AppData\Local\Temp\dc475e00d9bc4e94ab1d528a5540e67d.exe
"C:\Users\Admin\AppData\Local\Temp\dc475e00d9bc4e94ab1d528a5540e67d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe Draughtboard,Hurley
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 228
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1576

memory/1576-5-0x0000000001EE0000-0x0000000001EF1000-memory.dmp

Download

memory/1576-7-0x00000000024C0000-0x00000000024D1000-memory.dmp

Download