829d53beaf477b401883667122b54a965fe974f4c11fb2ba81335c8a13cbcc29

Analysis

Target

829d53beaf477b401883667122b54a965fe974f4c11fb2ba81335c8a13cbcc29.dll
Size

256KB
MD5

ea8801018764c994eeefd0281a04e9b9
SHA1

46e28b99e7a224366f7bf2c8b60260726d1cb1d7
SHA256

829d53beaf477b401883667122b54a965fe974f4c11fb2ba81335c8a13cbcc29
SHA512

0136bc0866d00c927a4255dc16288a6eacc02df94e2afdd22a25cb1926cec477e7c8102e3a8ca1ea32b21af57ab52ae072cf7c863e94154f712bd329a151999b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 1644 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2008 WerFault.exe
2008 WerFault.exe
2008 WerFault.exe
2008 WerFault.exe
2008 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2008 WerFault.exe

pid	pid_target	process	target process
2008	1644	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2008	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1644 wrote to memory of 2008	1644	rundll32.exe	WerFault.exe
PID 1644 wrote to memory of 2008	1644	rundll32.exe	WerFault.exe
PID 1644 wrote to memory of 2008	1644	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\829d53beaf477b401883667122b54a965fe974f4c11fb2ba81335c8a13cbcc29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

memory/2008-0-0x0000000000000000-mapping.dmp

Download
memory/2008-1-0x0000000001EF0000-0x0000000001F01000-memory.dmp

Filesize
68KB

Download
memory/2008-2-0x00000000027D0000-0x00000000027E1000-memory.dmp

Filesize
68KB

Download