812a50e952b3ef861abbb9e95ef624d41b7bb81388a647c2e118fcd72fe94f96

Analysis

Target

54103914ad1841cc640df893dd173154.dll
Size

256KB
MD5

2c248c1fec3326b4aca81a3573b81bf4
SHA1

4663178b7ee278518de2e5daf1b0c416b7afefc1
SHA256

812a50e952b3ef861abbb9e95ef624d41b7bb81388a647c2e118fcd72fe94f96
SHA512

664d978f64803705e889dfd56bad343a315c1a8e367bfcf996662666e1c586755589e023c5326d6f7a396823bc9c2e0b1fcc08c79e1c728474089338b6dfb99c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1496 1916 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1496 WerFault.exe

pid	pid_target	process	target process
1496	1916	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1496	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1916 wrote to memory of 1496	1916	rundll32.exe	WerFault.exe
PID 1916 wrote to memory of 1496	1916	rundll32.exe	WerFault.exe
PID 1916 wrote to memory of 1496	1916	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54103914ad1841cc640df893dd173154.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916

memory/1496-0-0x0000000000000000-mapping.dmp

Download
memory/1496-1-0x0000000001D20000-0x0000000001D31000-memory.dmp

Filesize
68KB

Download
memory/1496-2-0x0000000002620000-0x0000000002631000-memory.dmp

Filesize
68KB

Download
memory/1496-3-0x0000000002620000-0x0000000002631000-memory.dmp

Filesize
68KB

Download