829592e012673599d9aeacc98aec0c0292368e9ac0aea0626ab9dc055be48a00

Analysis

Target

829592e012673599d9aeacc98aec0c0292368e9ac0aea0626ab9dc055be48a00.dll
Size

256KB
MD5

b9bcd948a7ef1be2cf572a7be800e322
SHA1

ac47e548601a890d3935e616a326a492af8fe182
SHA256

829592e012673599d9aeacc98aec0c0292368e9ac0aea0626ab9dc055be48a00
SHA512

a1826d692fd0fba9752818eb4ac0b17636109111c5ea2bab89f6986ab68a7c765149b5880f66c009a6f4d441a414c3e81d1d0c3b1b466c93dcb91009ff32704e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1252 1944 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1252 WerFault.exe
1252 WerFault.exe
1252 WerFault.exe
1252 WerFault.exe
1252 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1252 WerFault.exe

pid	pid_target	process	target process
1252	1944	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1252	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 1252	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 1252	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 1252	1944	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\829592e012673599d9aeacc98aec0c0292368e9ac0aea0626ab9dc055be48a00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

memory/1252-0-0x0000000000000000-mapping.dmp

Download
memory/1252-1-0x0000000001DB0000-0x0000000001DC1000-memory.dmp

Filesize
68KB

Download
memory/1252-2-0x00000000025D0000-0x00000000025E1000-memory.dmp

Filesize
68KB

Download
memory/1252-3-0x00000000025D0000-0x00000000025E1000-memory.dmp

Filesize
68KB

Download