27dd13f1594175d1084205aea35467b025be2f0616fbf9dcd1b13bddc970640c

Analysis

Target

F195_chgsecmd.dll.87779CB7_4471_4686_BF22_4FA2C7F5A4A8.dll
Size

314KB
MD5

7bba684e58432fe347f71d3e2d914138
SHA1

4d7b0bb1e1bcf86b5b4ea2577581ad8b1a766a0c
SHA256

42c100ca7bb1085690ce3f89afb1eb61093e5ce9412cfa36566a0cc8137cea08
SHA512

1d7ba832cae73ebb85614af99632c946c9d0774c6acdd40fb368f39e9e685b1894903b11c09d074dea9685e03eefa25c310e54adec149022c6a93daca0092559

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1368 2028 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1368 WerFault.exe
1368 WerFault.exe
1368 WerFault.exe
1368 WerFault.exe
1368 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1368 WerFault.exe

pid	pid_target	process	target process
1368	2028	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1368	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1984 wrote to memory of 2028	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 2028	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 2028	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 2028	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 2028	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 2028	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 2028	1984	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1368	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1368	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1368	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1368	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F195_chgsecmd.dll.87779CB7_4471_4686_BF22_4FA2C7F5A4A8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F195_chgsecmd.dll.87779CB7_4471_4686_BF22_4FA2C7F5A4A8.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

memory/1368-4-0x0000000000000000-mapping.dmp

Download
memory/1368-5-0x0000000000A00000-0x0000000000A11000-memory.dmp

Filesize
68KB

Download
memory/1368-6-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2028-2-0x0000000000000000-mapping.dmp

Download
memory/2028-3-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download