a4b2989f1b811135300a7b05c627994dfe8a951b9f0c7eee957399583a04c7e1

Analysis

Target

a4b2989f1b811135300a7b05c627994dfe8a951b9f0c7eee957399583a04c7e1.dll
Size

254KB
MD5

73de9232f6bafbb572ef39f3460ccc50
SHA1

7a7b8591518af40a212ec03b9c32edecf7811023
SHA256

a4b2989f1b811135300a7b05c627994dfe8a951b9f0c7eee957399583a04c7e1
SHA512

c8699d3466382e8836b6ed67fb055d80ce50ab87e61b74fd3e42820269bfd8f83064ce9cc20710718251026cc19450d13c75d78281349bf2e167f5bd5b85fe6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1340 1068 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1340 WerFault.exe
1340 WerFault.exe
1340 WerFault.exe
1340 WerFault.exe
1340 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1340 WerFault.exe

pid	pid_target	process	target process
1340	1068	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1340	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1068 wrote to memory of 1340	1068	rundll32.exe	WerFault.exe
PID 1068 wrote to memory of 1340	1068	rundll32.exe	WerFault.exe
PID 1068 wrote to memory of 1340	1068	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4b2989f1b811135300a7b05c627994dfe8a951b9f0c7eee957399583a04c7e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068

memory/1340-0-0x0000000000000000-mapping.dmp

Download
memory/1340-1-0x0000000001E80000-0x0000000001E91000-memory.dmp

Filesize
68KB

Download
memory/1340-2-0x0000000002980000-0x0000000002991000-memory.dmp

Filesize
68KB

Download