e02483eca255879ba6a57365dbecb56f5049283d8cd3f030dceca5c69f7af161

Resubmissions

21-01-2021 15:28

19-11-2020 05:39

Target

WSGaRIW.dll
Size

140KB
MD5

4fbee1cbb17b4a05ae5b5431a76087fb
SHA1

44ffaa43eb2bba71325d406703ad82e010376cac
SHA256

e02483eca255879ba6a57365dbecb56f5049283d8cd3f030dceca5c69f7af161
SHA512

f1c0cf3e5f00e63d8edcb1cf171fde79b72945ab0d9bdd8a4ecb84b3a2b37d08eec0a59926b10a6cfaa97409a5bcb372805d09aab5e9248cde85bcb5b83fec93

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1924 created 392	1924	WerFault.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	392	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 392	2432	rundll32.exe	69
PID 2432 wrote to memory of 392	2432	rundll32.exe	69
PID 2432 wrote to memory of 392	2432	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WSGaRIW.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WSGaRIW.dll,#1
  2⤵
  PID:392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 720
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1924

memory/1924-1-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1924-8-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/1924-9-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download