17c5ff6458dda433431390ed6fde5919db0fb10dd6f201692541f6c90e5f21b5

Analysis

Target

17c5ff6458dda433431390ed6fde5919db0fb10dd6f201692541f6c90e5f21b5.dll
Size

304KB
MD5

3df64b48953d606b3b93a72bafc8b282
SHA1

4daeec6ef250790b6c69acaa5bf01ca3a0953585
SHA256

17c5ff6458dda433431390ed6fde5919db0fb10dd6f201692541f6c90e5f21b5
SHA512

107160dd1f08534afd889fd5870e38153c1c2bb909aebd1493b519c7db4257ebdf3e5f1609deb8739d8906f0d7a350c100a1ed756f0dd3ebfcd107f2edd931af

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 1744 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2032 WerFault.exe

pid	pid_target	process	target process
2032	1744	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2032	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1744 wrote to memory of 2032	1744	rundll32.exe	WerFault.exe
PID 1744 wrote to memory of 2032	1744	rundll32.exe	WerFault.exe
PID 1744 wrote to memory of 2032	1744	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17c5ff6458dda433431390ed6fde5919db0fb10dd6f201692541f6c90e5f21b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

memory/2032-0-0x0000000000000000-mapping.dmp

Download
memory/2032-1-0x0000000001EE0000-0x0000000001EF1000-memory.dmp

Filesize
68KB

Download
memory/2032-2-0x00000000026F0000-0x0000000002701000-memory.dmp

Filesize
68KB

Download