61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4

Analysis

Target

61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4.dll
Size

202KB
MD5

235d3a6e1bd1321f7b11f4d3649f4a55
SHA1

b642acd7a20f8632b577095cdff7ba689a1ee630
SHA256

61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4
SHA512

7cfbfbfaf1a6d6d00bf18e25d02e9e7e7440d69ddb0ad1e45d411c6263fdf577c204571c6068a0258975846e5162753763a2fc05455b8ef147f2dc48775845ce

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1520 1260 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1520 WerFault.exe
1520 WerFault.exe
1520 WerFault.exe
1520 WerFault.exe
1520 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1520 WerFault.exe

pid	pid_target	process	target process
1520	1260	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1520	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1260	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1260	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1260	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1260	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1260	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1260	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1260	1924	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1520	1260	rundll32.exe	WerFault.exe
PID 1260 wrote to memory of 1520	1260	rundll32.exe	WerFault.exe
PID 1260 wrote to memory of 1520	1260	rundll32.exe	WerFault.exe
PID 1260 wrote to memory of 1520	1260	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1260

memory/1260-0-0x0000000000000000-mapping.dmp

Download
memory/1260-3-0x0000000000000000-mapping.dmp

Download
memory/1520-1-0x0000000000000000-mapping.dmp

Download
memory/1520-2-0x0000000002150000-0x0000000002161000-memory.dmp

Filesize
68KB

Download
memory/1520-4-0x0000000002850000-0x0000000002861000-memory.dmp

Filesize
68KB

Download