0104cff93a4ca0673860db9773693712c3f595f567b7b4b560da62697fb7a00c

Analysis

Target

859133cc234225f8038f97e01f30c87f.dll
Size

256KB
MD5

7586a84ad41fefdefd7e228204836192
SHA1

5f45c38b21ff07d510c6173f138aa90a15826199
SHA256

0104cff93a4ca0673860db9773693712c3f595f567b7b4b560da62697fb7a00c
SHA512

91fc032d437e207e590a9ab0b25a7ace67b9686a65388188a9dbb1783a93136089ded435520077c972f64e493a5decf74b1f835278c0ce42ffe973f6977f947e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1524 2036 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1524 WerFault.exe
1524 WerFault.exe
1524 WerFault.exe
1524 WerFault.exe
1524 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1524 WerFault.exe

pid	pid_target	process	target process
1524	2036	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1524	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1524	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 1524	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 1524	2036	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\859133cc234225f8038f97e01f30c87f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2036 -s 108
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1524

memory/1524-0-0x0000000000000000-mapping.dmp

Download
memory/1524-1-0x0000000002050000-0x0000000002061000-memory.dmp

Filesize
68KB

Download
memory/1524-2-0x00000000027A0000-0x00000000027B1000-memory.dmp

Filesize
68KB

Download