892b527aa1af87a0a572b9c86be5aedb1ab3f9f68775b9fa0e6cc6bba069f9d3

Analysis

Target

3a6af9b8a093832ce3baff8d9a2f1bd5.dll
Size

255KB
MD5

d59a81c4e8d9de5c6800bf0c153d4f79
SHA1

14c85cb393c5eae6fce702acc8f110737486db09
SHA256

892b527aa1af87a0a572b9c86be5aedb1ab3f9f68775b9fa0e6cc6bba069f9d3
SHA512

1cfbe94e77085180d0d832087679fb208d8e9fcf7b9f1b7808e57c238116e487054366a693e61111d2017ab035bc927ecdfc99eb702056fa4d917f12319a4657

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1092 1808 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1092 WerFault.exe
1092 WerFault.exe
1092 WerFault.exe
1092 WerFault.exe
1092 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1092 WerFault.exe

pid	pid_target	process	target process
1092	1808	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1092	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1808 wrote to memory of 1092	1808	rundll32.exe	WerFault.exe
PID 1808 wrote to memory of 1092	1808	rundll32.exe	WerFault.exe
PID 1808 wrote to memory of 1092	1808	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6af9b8a093832ce3baff8d9a2f1bd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1808 -s 128
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1092

memory/1092-0-0x0000000000000000-mapping.dmp

Download
memory/1092-1-0x0000000002070000-0x0000000002081000-memory.dmp

Filesize
68KB

Download
memory/1092-2-0x00000000027A0000-0x00000000027B1000-memory.dmp

Filesize
68KB

Download