9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3

Analysis

Target

9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3.dll
Size

208KB
MD5

3b938742cb476f22f9a8cb10f56e49c1
SHA1

b42eaf210ca625cbd9ea0be256e7c9c3f60aaa77
SHA256

9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3
SHA512

cfae784948a4f7164925f94fe57d2dddd41150d45900041e36022192fe379377dbbf7a2cd357551ffb5da5a1359efa769c07b8f64b3c7ae71cb4d5139e7867ce

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 1664 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2036 WerFault.exe
2036 WerFault.exe
2036 WerFault.exe
2036 WerFault.exe
2036 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2036 WerFault.exe

pid	pid_target	process	target process
2036	1664	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2036	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 760 wrote to memory of 1664	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1664	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1664	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1664	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1664	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1664	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1664	760	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 2036	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 2036	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 2036	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 2036	1664	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9887a513b16ab661aabdf578ba8b60ca90d042a505710e357fe6f4a0dd08ade3.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

memory/1664-0-0x0000000000000000-mapping.dmp

Download
memory/1664-3-0x0000000000000000-mapping.dmp

Download
memory/2036-1-0x0000000000000000-mapping.dmp

Download
memory/2036-2-0x0000000002100000-0x0000000002111000-memory.dmp

Filesize
68KB

Download
memory/2036-4-0x0000000002690000-0x00000000026A1000-memory.dmp

Filesize
68KB

Download