29ae4b20f4cce024d998ed348ebbde4e9ab28f1c5211c7a5adf64fa8055b0bf9

Analysis

Target

29ae4b20f4cce024d998ed348ebbde4e9ab28f1c5211c7a5adf64fa8055b0bf9.dll
Size

254KB
MD5

cff2a880d3db1bc4c03149013068f394
SHA1

2061c5fbc58174a43c987fd0648a823d7189fc98
SHA256

29ae4b20f4cce024d998ed348ebbde4e9ab28f1c5211c7a5adf64fa8055b0bf9
SHA512

17bf2c116b1f3979fe7f5215b9a73a69e536a1468f9787431322c51697c3dc6571c23e9972ea62ad5287066bc5d5e8bd835ae57dfb61aea58266fff22abd0053

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1200 1032 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1200 WerFault.exe
1200 WerFault.exe
1200 WerFault.exe
1200 WerFault.exe
1200 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1200 WerFault.exe

pid	pid_target	process	target process
1200	1032	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1200	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1032 wrote to memory of 1200	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 1200	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 1200	1032	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29ae4b20f4cce024d998ed348ebbde4e9ab28f1c5211c7a5adf64fa8055b0bf9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

memory/1200-0-0x0000000000000000-mapping.dmp

Download
memory/1200-1-0x0000000001E90000-0x0000000001EA1000-memory.dmp

Filesize
68KB

Download
memory/1200-2-0x00000000027D0000-0x00000000027E1000-memory.dmp

Filesize
68KB

Download