61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4

Analysis

Target

61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4.dll
Size

202KB
MD5

235d3a6e1bd1321f7b11f4d3649f4a55
SHA1

b642acd7a20f8632b577095cdff7ba689a1ee630
SHA256

61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4
SHA512

7cfbfbfaf1a6d6d00bf18e25d02e9e7e7440d69ddb0ad1e45d411c6263fdf577c204571c6068a0258975846e5162753763a2fc05455b8ef147f2dc48775845ce

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3028 804 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3028	804	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3028 WerFault.exe
Token: SeBackupPrivilege 3028 WerFault.exe
Token: SeDebugPrivilege 3028 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 508 wrote to memory of 804	508	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 804	508	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 804	508	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b66befa008eb20c7f14af9d3f3217da2b16a4bc2ed7f6d1a6fa0b1b5774dd4.dll,#1
2⤵
PID:804

memory/804-0-0x0000000000000000-mapping.dmp

Download
memory/804-2-0x0000000000000000-mapping.dmp

Download
memory/804-3-0x0000000000000000-mapping.dmp

Download
memory/804-4-0x0000000000000000-mapping.dmp

Download
memory/804-5-0x0000000000000000-mapping.dmp

Download
memory/3028-1-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/3028-6-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download