8eada491e7fbd8285407897b678b1a3d480c416244db821cfaca0f27ab27901a

Analysis

Target
ce.exe.dll
Size 28KB
Sample210322-ay61e967h2
SHA256 8eada491e7fbd8285407897b678b1a3d480c416244db821cfaca0f27ab27901a
MD5 fa9e686b811a1d921623947b8fd56337
SHA1 6fd0a05f1273f1a5cb79872c452266b5788fc0f3
SHA512 44779a2364a9dbcaba5393fa0b4b2fa29f9b4ac7228f04a11344887e965bad29250e32cacb91db9d876563fe1e1047d98bac322a329563d883e15b9be5a7a85e
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	3608	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 3608	732	rundll32.exe	68
PID 732 wrote to memory of 3608	732	rundll32.exe	68
PID 732 wrote to memory of 3608	732	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce.exe.dll,#1
  2⤵
  PID:3608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 668
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2420

memory/2420-3-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download