a95f0ca64023607f3de2d1c78caa835eb3f525994c7fac5c817eb93fc7f9e9d4

General

Target

SecuriteInfo.com.Variant.Graftor.752710.32324.11949.dll
Size

3.3MB
MD5

257987409335f6287a254f9ced2bf728
SHA1

e084a1a26d6f856d574303e3439b345703c894b3
SHA256

a95f0ca64023607f3de2d1c78caa835eb3f525994c7fac5c817eb93fc7f9e9d4
SHA512

241c4f4516502e6b941e1553760a898aac23bd767181fd774bc003b498598934f3a3bffd4ab28048dc65cf3ec9812943943a9e9b409832f9f9e0d2a042c8c102

Score

8^/10

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 1348 rundll32.exe
6 1348 rundll32.exe
7 1348 rundll32.exe
10 1348 rundll32.exe
11 1348 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1352 1876 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1352 WerFault.exe
1352 WerFault.exe
1352 WerFault.exe
1352 WerFault.exe
1352 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1352 WerFault.exe

pid	pid_target	process	target process
1352	1876	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1352	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1756 wrote to memory of 1876	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1876	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1876	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1876	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1876	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1876	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1876	1756	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1348	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1348	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1348	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1348	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1348	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1348	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1348	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1352	1876	rundll32.exe	WerFault.exe
PID 1876 wrote to memory of 1352	1876	rundll32.exe	WerFault.exe
PID 1876 wrote to memory of 1352	1876	rundll32.exe	WerFault.exe
PID 1876 wrote to memory of 1352	1876	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.32324.11949.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.32324.11949.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.32324.11949.dll,f0
3⤵
- Blocklisted process makes network request
PID:1348

memory/1348-1-0x0000000000000000-mapping.dmp

Download
memory/1352-2-0x0000000000000000-mapping.dmp

Download
memory/1352-3-0x0000000001F60000-0x0000000001F71000-memory.dmp

Filesize
68KB

Download
memory/1352-6-0x0000000002580000-0x0000000002591000-memory.dmp

Filesize
68KB

Download
memory/1876-0-0x0000000000000000-mapping.dmp

Download
memory/1876-4-0x0000000000000000-mapping.dmp

Download
memory/1876-5-0x0000000000000000-mapping.dmp

Download