77650b321630c0c52663e766bd245d28558f5cf11daa55045b9a97f5f3084810

Analysis

Target

77650b321630c0c52663e766bd245d28558f5cf11daa55045b9a97f5f3084810.dll
Size

254KB
MD5

8dd9391ba8edbe49c8634e1506ba9faa
SHA1

d73f98361bc959a6f406a7af5f69ef8c3c0bb4a0
SHA256

77650b321630c0c52663e766bd245d28558f5cf11daa55045b9a97f5f3084810
SHA512

97395cc55476eeecc728cc9f486a55771cf7f1dc9da2488555f5fecfc306fd8e3d521cde44a30444639ff822fe1329c09fc401170e9b1388a923cdc1b4aee79e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1460 1924 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1460 WerFault.exe

pid	pid_target	process	target process
1460	1924	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1460	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1460	1924	rundll32.exe	WerFault.exe
PID 1924 wrote to memory of 1460	1924	rundll32.exe	WerFault.exe
PID 1924 wrote to memory of 1460	1924	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77650b321630c0c52663e766bd245d28558f5cf11daa55045b9a97f5f3084810.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

memory/1460-0-0x0000000000000000-mapping.dmp

Download
memory/1460-1-0x0000000001F50000-0x0000000001F61000-memory.dmp

Filesize
68KB

Download
memory/1460-2-0x00000000027D0000-0x00000000027E1000-memory.dmp

Filesize
68KB

Download