e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa

Analysis

Target

e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa.dll
Size

202KB
MD5

c98df0fc1bae93c9a904ac4c0dde5106
SHA1

4c28ac10e5a9cb231a9886942bcff1647e8e3632
SHA256

e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa
SHA512

d6d84a1fcecb588eb702c79b006be2929a96085152c11a5c22e18d83e19953a4647e7d092c653c1a18c6e10ed37e7e2ef86a085f21cb04ead7d63b159f113fe8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1892 2932 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1892	2932	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1892 WerFault.exe
Token: SeBackupPrivilege 1892 WerFault.exe
Token: SeDebugPrivilege 1892 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3936 wrote to memory of 2932	3936	rundll32.exe	rundll32.exe
PID 3936 wrote to memory of 2932	3936	rundll32.exe	rundll32.exe
PID 3936 wrote to memory of 2932	3936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e69fc42be5857f3535d8f2dd24cac1cd1f23bd9c88a5fe7aad3cf1ce7d1a5eaa.dll,#1
2⤵
PID:2932

memory/1892-1-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/1892-6-0x00000000059A0000-0x00000000059A1000-memory.dmp

Filesize
4KB

Download
memory/2932-0-0x0000000000000000-mapping.dmp

Download
memory/2932-2-0x0000000000000000-mapping.dmp

Download
memory/2932-3-0x0000000000000000-mapping.dmp

Download
memory/2932-4-0x0000000000000000-mapping.dmp

Download
memory/2932-5-0x0000000000000000-mapping.dmp

Download