d702d8b0a40a03bd11d5a645d2da52228e9275e68531c390b65a77709a8e3e86

General

Target

Dumped_Beacon_DLL_powershell_ise_exe_PIDd7c_hiddenmodule_4480000_x86.dll
Size

248KB
MD5

7d55a3f0151b59a1a28a8bb0519176be
SHA1

4dc08fc88a7c8af4557df0a0b28df5b67751c1e3
SHA256

0d0c1dc04c2a607e0042f4611a1b975cae82b3bb7e5e5ff912f23924ee1b88c5
SHA512

440fec1b76830ff35146b7ad2cc082e64e5ac39cde120849442cdf2ea265e0e5a5d107ae204cdfe367deca7d478bb46061d06530bf7983ddbde61918aecb1d0d

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2112 created 1908 2112 WerFault.exe rundll32.exe

description	pid	process	target process
PID 2112 created 1908	2112	WerFault.exe	rundll32.exe

ServiceHost packer 6 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/1908-3-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1908-2-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1908-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1908-6-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1908-7-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1908-9-0x0000000000000000-mapping.dmp	servicehost

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1084 1908 WerFault.exe rundll32.exe
2112 1908 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1084	1908	WerFault.exe	rundll32.exe
2112	1908	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

WerFault.exeWerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

WerFault.exeWerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1344 wrote to memory of 1908	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1908	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1908	1344	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dumped_Beacon_DLL_powershell_ise_exe_PIDd7c_hiddenmodule_4480000_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dumped_Beacon_DLL_powershell_ise_exe_PIDd7c_hiddenmodule_4480000_x86.dll,#1
2⤵
PID:1908

memory/1084-1-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/1084-5-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/1908-0-0x0000000000000000-mapping.dmp

Download
memory/1908-3-0x0000000000000000-mapping.dmp

Download
memory/1908-2-0x0000000000000000-mapping.dmp

Download
memory/1908-4-0x0000000000000000-mapping.dmp

Download
memory/1908-6-0x0000000000000000-mapping.dmp

Download
memory/1908-7-0x0000000000000000-mapping.dmp

Download
memory/1908-9-0x0000000000000000-mapping.dmp

Download
memory/2112-8-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/2112-10-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download