214e3cd3db2fd521d7a66d0e4ede79c152870ff0330f839d01d7cc141cdc0a14

General

Target

SecuriteInfo.com.Variant.Graftor.752710.8384.15318.dll
Size

3.3MB
MD5

90ac2235ac7890cd0a7c39aedee49302
SHA1

2e6a5a180e757ef69402d20ae21c7dfc5cf96950
SHA256

214e3cd3db2fd521d7a66d0e4ede79c152870ff0330f839d01d7cc141cdc0a14
SHA512

349d7cb55bfc05815d5949d8009c45e7fdd9665649b67ecd4a7162a2fa153fc09ca3ad17b3617b8c1df3a677c713ee6e701067a5fc2a8b5257b8678d88be96c7

Score

8^/10

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

4 1312 rundll32.exe
7 1312 rundll32.exe
8 1312 rundll32.exe
9 1312 rundll32.exe
12 1312 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 2008 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1552 WerFault.exe
1552 WerFault.exe
1552 WerFault.exe
1552 WerFault.exe
1552 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1552 WerFault.exe

pid	pid_target	process	target process
1552	2008	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1552	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1040 wrote to memory of 2008	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 2008	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 2008	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 2008	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 2008	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 2008	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 2008	1040	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1312	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1312	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1312	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1312	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1312	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1312	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1312	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1552	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1552	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1552	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1552	2008	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.8384.15318.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.8384.15318.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.8384.15318.dll,f0
3⤵
- Blocklisted process makes network request
PID:1312

memory/1312-1-0x0000000000000000-mapping.dmp

Download
memory/1552-2-0x0000000000000000-mapping.dmp

Download
memory/1552-3-0x0000000001F50000-0x0000000001F61000-memory.dmp

Filesize
68KB

Download
memory/1552-6-0x0000000002550000-0x0000000002561000-memory.dmp

Filesize
68KB

Download
memory/2008-0-0x0000000000000000-mapping.dmp

Download
memory/2008-5-0x0000000000000000-mapping.dmp

Download
memory/2008-4-0x0000000000000000-mapping.dmp

Download