e02483eca255879ba6a57365dbecb56f5049283d8cd3f030dceca5c69f7af161

Resubmissions

21-01-2021 15:28

19-11-2020 05:39

Target

WSGaRIW.dll
Size

140KB
MD5

4fbee1cbb17b4a05ae5b5431a76087fb
SHA1

44ffaa43eb2bba71325d406703ad82e010376cac
SHA256

e02483eca255879ba6a57365dbecb56f5049283d8cd3f030dceca5c69f7af161
SHA512

f1c0cf3e5f00e63d8edcb1cf171fde79b72945ab0d9bdd8a4ecb84b3a2b37d08eec0a59926b10a6cfaa97409a5bcb372805d09aab5e9248cde85bcb5b83fec93

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1924 created 392 1924 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 392 WerFault.exe rundll32.exe

description	pid	process	target process
PID 1924 created 392	1924	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
1924	392	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1924 WerFault.exe
Token: SeBackupPrivilege 1924 WerFault.exe
Token: SeDebugPrivilege 1924 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2432 wrote to memory of 392	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 392	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 392	2432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WSGaRIW.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WSGaRIW.dll,#1
  2⤵
  PID:392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 720
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1924

memory/392-0-0x0000000000000000-mapping.dmp

Download
memory/392-3-0x0000000000000000-mapping.dmp

Download
memory/392-2-0x0000000000000000-mapping.dmp

Download
memory/392-5-0x0000000000000000-mapping.dmp

Download
memory/392-4-0x0000000000000000-mapping.dmp

Download
memory/392-6-0x0000000000000000-mapping.dmp

Download
memory/392-7-0x0000000000000000-mapping.dmp

Download
memory/1924-1-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1924-8-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/1924-9-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download