1d107c6a40ea4587904c46a5e1b0536ac6ab2e0182a2c05dc2d677723652f2b9

Analysis

Target

1d107c6a40ea4587904c46a5e1b0536ac6ab2e0182a2c05dc2d677723652f2b9.dll
Size

256KB
MD5

07281bad5bfb51fc0d8854af34e75e8f
SHA1

21b59cd030e6f11546442e390c4d2ea5d2755279
SHA256

1d107c6a40ea4587904c46a5e1b0536ac6ab2e0182a2c05dc2d677723652f2b9
SHA512

93623b283bc9f8b2fe4140bb81bfd4a42844a5ec62e9f7f4e6ca22a8cd199ae930bb3651ea98f5b4d900b777d631f7d5d71db399bcf4225b447e2fab8cf0beb6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1128 1912 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1128 WerFault.exe
1128 WerFault.exe
1128 WerFault.exe
1128 WerFault.exe
1128 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1128 WerFault.exe

pid	pid_target	process	target process
1128	1912	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1128	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1912 wrote to memory of 1128	1912	rundll32.exe	WerFault.exe
PID 1912 wrote to memory of 1128	1912	rundll32.exe	WerFault.exe
PID 1912 wrote to memory of 1128	1912	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d107c6a40ea4587904c46a5e1b0536ac6ab2e0182a2c05dc2d677723652f2b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

memory/1128-1-0x0000000001DD0000-0x0000000001DE1000-memory.dmp

Filesize
68KB

Download
memory/1128-0-0x0000000000000000-mapping.dmp

Download
memory/1128-2-0x0000000002680000-0x0000000002691000-memory.dmp

Filesize
68KB

Download