ac6cefea98f8d99848ed620ac10cea79459ffd97d6397dc1f43d1a784f220858

Analysis

Target

ac6cefea98f8d99848ed620ac10cea79459ffd97d6397dc1f43d1a784f220858.dll
Size

256KB
MD5

9b7cefccf030c4ff50cff54248d4f1fc
SHA1

de707e5f50d5da43766802ac9859bc19b73362cf
SHA256

ac6cefea98f8d99848ed620ac10cea79459ffd97d6397dc1f43d1a784f220858
SHA512

5181b06686cd0edc3b8f72ab81a589329552618a8403b81e96c9139643e2ef4e8b98c8d6980c042e6f404461eacc9201097dc4159b194d2b0925c7edf287a1e7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1496 1668 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1496 WerFault.exe

pid	pid_target	process	target process
1496	1668	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1496	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1668 wrote to memory of 1496	1668	rundll32.exe	WerFault.exe
PID 1668 wrote to memory of 1496	1668	rundll32.exe	WerFault.exe
PID 1668 wrote to memory of 1496	1668	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac6cefea98f8d99848ed620ac10cea79459ffd97d6397dc1f43d1a784f220858.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

memory/1496-0-0x0000000000000000-mapping.dmp

Download
memory/1496-1-0x0000000001F60000-0x0000000001F71000-memory.dmp

Filesize
68KB

Download
memory/1496-2-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download