f99723f1961f7ba1ea05a528a60558df653fac5a4046cfa70865419548e51fc8

Analysis

Target

file.dll
Size

164KB
MD5

e3e62e3291cf55ee8f7ffa6db93723b4
SHA1

5531c9c5d8f22321e711185dff65463f67b58567
SHA256

f99723f1961f7ba1ea05a528a60558df653fac5a4046cfa70865419548e51fc8
SHA512

0ecdfc0743d2d0626b95fdd269aba207f0db536ea79d18bbd2247410dc25e2c9e11d0d84a11111eddce5a51ab1b440eaf43addddbde85f088a89fe970a479fba

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 728 created 4764 728 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

728 4764 WerFault.exe rundll32.exe

description	pid	process	target process
PID 728 created 4764	728	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
728	4764	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 728 WerFault.exe
Token: SeBackupPrivilege 728 WerFault.exe
Token: SeDebugPrivilege 728 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4688 wrote to memory of 4764	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 4764	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 4764	4688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:4764

memory/728-1-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/728-9-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/728-10-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/4764-0-0x0000000000000000-mapping.dmp

Download
memory/4764-3-0x0000000000000000-mapping.dmp

Download
memory/4764-4-0x0000000000000000-mapping.dmp

Download
memory/4764-2-0x0000000000000000-mapping.dmp

Download
memory/4764-5-0x0000000000000000-mapping.dmp

Download
memory/4764-8-0x0000000000000000-mapping.dmp

Download
memory/4764-7-0x0000000000000000-mapping.dmp

Download
memory/4764-6-0x0000000000000000-mapping.dmp

Download