504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708

General

Target

SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll
Size

3.3MB
MD5

b5d1fc220f0ad4ae724a50f2a681716d
SHA1

fa6e36d08a36f06c417af13a799cd4570357474c
SHA256

504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708
SHA512

9c34dd5e47b677b390dd41e3823f39f0ce726bb3af4cb75291186bd82634af424b2f3a24223aae3a0a47886cee9fd8386bb4a9aeebbb0f0e9435097549600cab

Score

8^/10

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 1700 rundll32.exe
6 1700 rundll32.exe
7 1700 rundll32.exe
10 1700 rundll32.exe
13 1700 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

484 900 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

484 WerFault.exe
484 WerFault.exe
484 WerFault.exe
484 WerFault.exe
484 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 484 WerFault.exe

pid	pid_target	process	target process
484	900	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	484	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 900	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 900	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 900	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 900	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 900	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 900	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 900	1904	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1700	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1700	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1700	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1700	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1700	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1700	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1700	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 484	900	rundll32.exe	WerFault.exe
PID 900 wrote to memory of 484	900	rundll32.exe	WerFault.exe
PID 900 wrote to memory of 484	900	rundll32.exe	WerFault.exe
PID 900 wrote to memory of 484	900	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,f0
3⤵
- Blocklisted process makes network request
PID:1700

memory/484-2-0x0000000000000000-mapping.dmp

Download
memory/484-3-0x0000000002320000-0x0000000002331000-memory.dmp

Filesize
68KB

Download
memory/484-6-0x00000000024B0000-0x00000000024C1000-memory.dmp

Filesize
68KB

Download
memory/900-0-0x0000000000000000-mapping.dmp

Download
memory/900-5-0x0000000000000000-mapping.dmp

Download
memory/900-4-0x0000000000000000-mapping.dmp

Download
memory/1700-1-0x0000000000000000-mapping.dmp

Download