82e970c5d027433a241310e8f0ab9c633765a0b872ead9dea43451ef9b1619e5

Analysis

Target

82e970c5d027433a241310e8f0ab9c633765a0b872ead9dea43451ef9b1619e5.dll
Size

304KB
MD5

1f56173ad9cc9afb22f3f81140116a1f
SHA1

f511669d6bf71bbcc9b440c30c1ef79eb7513d01
SHA256

82e970c5d027433a241310e8f0ab9c633765a0b872ead9dea43451ef9b1619e5
SHA512

2e6cc2260848994890fd470ca5168ed270757a0952bbd58878d890e0b9b0c9e78e44fecc196d597214f4d5444163bef3180ae7f9af8fe1817e55254ba260cdce

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1568 2028 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1568 WerFault.exe
1568 WerFault.exe
1568 WerFault.exe
1568 WerFault.exe
1568 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1568 WerFault.exe

pid	pid_target	process	target process
1568	2028	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1568	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 1568	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1568	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1568	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82e970c5d027433a241310e8f0ab9c633765a0b872ead9dea43451ef9b1619e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

memory/1568-0-0x0000000000000000-mapping.dmp

Download
memory/1568-1-0x0000000001F50000-0x0000000001F61000-memory.dmp

Filesize
68KB

Download
memory/1568-2-0x0000000002760000-0x0000000002771000-memory.dmp

Filesize
68KB

Download