1a12175ecb129ef75771d2430081f3643a2c0c89e420a34b36b5c15ed1d24d99

Analysis

Target

1a12175ecb129ef75771d2430081f3643a2c0c89e420a34b36b5c15ed1d24d99.dll
Size

256KB
MD5

ec070503faac9acc9e52bba6b06bfa97
SHA1

42aae5bea6e932bb78e2aa478aad6de5ae73c939
SHA256

1a12175ecb129ef75771d2430081f3643a2c0c89e420a34b36b5c15ed1d24d99
SHA512

45ab13392763a2fbbee777617b7b7acfc398b77ba1eb2a6463a2aed4798beb71074dda10fb964e59a48dd01dcb7b6739e6b4c33d3f5b44d98f6ce8352aa92b4a

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2044 1056 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2044 WerFault.exe

pid	pid_target	process	target process
2044	1056	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2044	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1056 wrote to memory of 2044	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 2044	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 2044	1056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a12175ecb129ef75771d2430081f3643a2c0c89e420a34b36b5c15ed1d24d99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

memory/2044-0-0x0000000000000000-mapping.dmp

Download
memory/2044-1-0x0000000001E10000-0x0000000001E21000-memory.dmp

Filesize
68KB

Download
memory/2044-2-0x00000000028D0000-0x00000000028E1000-memory.dmp

Filesize
68KB

Download