f9cf0fafb332a52c2d95e3d18ad6b0f3d7836166fb105cb38970bec2bddd1daa

Analysis

Target

SUNBURST/FireEyeTools/078403b4e89ff06d2fe2ed7e75428a381f83ffb708dbd01b0220767498947f0c.dll
Size

14KB
MD5

5125979110847d35a338caac6bff2aa8
SHA1

218651ac5b575c3f9642c2e9a5928aa22fab8483
SHA256

078403b4e89ff06d2fe2ed7e75428a381f83ffb708dbd01b0220767498947f0c
SHA512

a19ceab78ee6d84ee1b8d42118e428f4f2e4b4500081fe8e1c38beed5386a692149113af01577e8f7b95034f2f2610be097385313bcb87d409470b78010bb369

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3268	1808	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1808	8	regsvr32.exe	71
PID 8 wrote to memory of 1808	8	regsvr32.exe	71
PID 8 wrote to memory of 1808	8	regsvr32.exe	71

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SUNBURST\FireEyeTools\078403b4e89ff06d2fe2ed7e75428a381f83ffb708dbd01b0220767498947f0c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SUNBURST\FireEyeTools\078403b4e89ff06d2fe2ed7e75428a381f83ffb708dbd01b0220767498947f0c.dll
  2⤵
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 604
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3268

memory/3268-3-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download