0b7a0dee5961536b4ffabb9bac761478223e2c7a79e98c866139af60adf9e79b

Analysis

Target

0b7a0dee5961536b4ffabb9bac761478223e2c7a79e98c866139af60adf9e79b.dll
Size

304KB
MD5

10c6b6a828f631799993e66485823fb2
SHA1

68bdf62e533bce4eb2ebc863d03895b090dc09f4
SHA256

0b7a0dee5961536b4ffabb9bac761478223e2c7a79e98c866139af60adf9e79b
SHA512

ae099300aacd6f6109c0d6224b500a9f3dabe4aad3db30b1f71988fa3223163e50fd0b0655bd0f69c79494c09c7e1af3ed60d35a6a61c9434fd054b7014c2faf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1472 1900 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1472 WerFault.exe
1472 WerFault.exe
1472 WerFault.exe
1472 WerFault.exe
1472 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1472 WerFault.exe

pid	pid_target	process	target process
1472	1900	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1472	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1900 wrote to memory of 1472	1900	rundll32.exe	WerFault.exe
PID 1900 wrote to memory of 1472	1900	rundll32.exe	WerFault.exe
PID 1900 wrote to memory of 1472	1900	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b7a0dee5961536b4ffabb9bac761478223e2c7a79e98c866139af60adf9e79b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

memory/1472-0-0x0000000000000000-mapping.dmp

Download
memory/1472-1-0x0000000001DE0000-0x0000000001DF1000-memory.dmp

Filesize
68KB

Download
memory/1472-2-0x0000000002780000-0x0000000002791000-memory.dmp

Filesize
68KB

Download