9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7

Target

b5b2765aaf97ae9c22abd312e684616d.dll
Size

820KB
MD5

b5b2765aaf97ae9c22abd312e684616d
SHA1

a66a652c2067f7489b83aba3b78502c0f482863b
SHA256

9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7
SHA512

af6c0a6c582a0cfd4f7de6bf1cf0199898b31edc0dba5467a499c2148e425d91d556bd7eebd08faf093d610cbf2afbee2237affc206106c7209cb2492a563279

Score

10^/10

Malware Config

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3104 created 1232 3104 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3104 1232 WerFault.exe rundll32.exe

description	pid	process	target process
PID 3104 created 1232	3104	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
3104	1232	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3104 WerFault.exe
Token: SeBackupPrivilege 3104 WerFault.exe
Token: SeDebugPrivilege 3104 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1160 wrote to memory of 1232	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1232	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1232	1160	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5b2765aaf97ae9c22abd312e684616d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5b2765aaf97ae9c22abd312e684616d.dll,#1
  2⤵
  PID:1232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 580
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3104

memory/1232-2-0x0000000000000000-mapping.dmp

Download
memory/1232-4-0x0000000000000000-mapping.dmp

Download
memory/1232-5-0x0000000000000000-mapping.dmp

Download
memory/3104-3-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3104-6-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download