2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538

Analysis

Target

2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll
Size

199KB
MD5

5d0bbc4db7f2771b87c4aa5389381a3a
SHA1

82a9e68b18f84c31b71cecbdf1f983067b70ec06
SHA256

2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538
SHA512

797052afcefd402423b9112aa968eaf9b7c2998f525ad9347ee86f4d0c8336f5f52ce9c5ba2a5c3bebe1b142fdc47b141414a0125e8e2fe1d3a285122bbb20a3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2016 1920 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2016 WerFault.exe
2016 WerFault.exe
2016 WerFault.exe
2016 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2016 WerFault.exe

pid	pid_target	process	target process
2016	1920	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2016	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 344 wrote to memory of 1920	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1920	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1920	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1920	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1920	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1920	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1920	344	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 2016	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 2016	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 2016	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 2016	1920	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2083b575bca73c7b9711a8196b5d74fa2c32225c978881794449e0f96eab7538.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 244
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2016

memory/1920-0-0x0000000000000000-mapping.dmp

Download
memory/1920-3-0x0000000000000000-mapping.dmp

Download
memory/2016-1-0x0000000000000000-mapping.dmp

Download
memory/2016-2-0x0000000001FF0000-0x0000000002001000-memory.dmp

Filesize
68KB

Download
memory/2016-4-0x00000000027D0000-0x00000000027E1000-memory.dmp

Filesize
68KB

Download