183b4e8853977551d6bf68ce7d1ecb386af257e1b2d6f954505d10413f2fe39d

Analysis

Target
imgengine.dll
Size 10.9MB
Sample201212-zkcmrdqb2a
SHA256 183b4e8853977551d6bf68ce7d1ecb386af257e1b2d6f954505d10413f2fe39d
MD5 cdc83307e7b148e3ee11d864587d8e9b
SHA1 ac774cfc16a5bf78b04e04aa4db6eda95cf03781
SHA512 820cf8b90adaea3ef122bb03f107480d099c2b374ff819c0321cdc86efc6d66ed5a49c090faa765f6cbcb9b9c6a1bc03b59d114ee3224983086c0d9c937231ac
MD5 SHA1 SHA512

Score

9^/10

ServiceHost packer 4 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/1228-5-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1228-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1228-6-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1228-7-0x0000000000000000-mapping.dmp	servicehost

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3180	1228	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1228	540	rundll32.exe	71
PID 540 wrote to memory of 1228	540	rundll32.exe	71
PID 540 wrote to memory of 1228	540	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\imgengine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\imgengine.dll,#1
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 796
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3180

memory/3180-3-0x0000000005040000-0x0000000005041000-memory.dmp

Download

memory/3180-8-0x0000000005870000-0x0000000005871000-memory.dmp

Download