d2f0049cd462aa2fadc04698f15209d5f31c185d3b99f71e8f564f20ae9b9d51

Analysis

Target
b3.dll
Size 567KB
Sample200909-ftlact8z6s
SHA256 d2f0049cd462aa2fadc04698f15209d5f31c185d3b99f71e8f564f20ae9b9d51
MD5 61312dc37b2ebdf09ddecf5084978343
SHA1 95344d9e72b44332d169d23ea2a538057f231456
SHA512 765017da2a9a709ee90bb10bcff8c2d6e32cf24d73974040f7312568505c504ea9140a168ed997b727a02469e04ef40bf96364f0cc3a60cd5022672d788cf5bd
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	412	WerFault.exe	67

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 007a331bba86d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1292	svchost.exe
Token: SeCreatePagefilePrivilege	1292	svchost.exe
Token: SeRestorePrivilege	2440	WerFault.exe
Token: SeBackupPrivilege	2440	WerFault.exe
Token: SeDebugPrivilege	2440	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 412	3888	rundll32.exe	67
PID 3888 wrote to memory of 412	3888	rundll32.exe	67
PID 3888 wrote to memory of 412	3888	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3.dll,#1
  2⤵
  PID:412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 612
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2440

memory/2440-1-0x0000000004540000-0x0000000004541000-memory.dmp

Download

memory/2440-5-0x0000000004D30000-0x0000000004D31000-memory.dmp

Download