4305827d45feb5eb49479582d15b1bc3ef1135d544f6c4ac0829014b06e81fd7

Analysis

Target

tirckBot_fixed_04D60000.bin.dll
Size

2.1MB
MD5

6d40412e4dc3bdd43615d84b4e7777f5
SHA1

94b3f503724b9d0c24a4e06c129af8846125a2c5
SHA256

4305827d45feb5eb49479582d15b1bc3ef1135d544f6c4ac0829014b06e81fd7
SHA512

a64d7dfc622e0c5c0719702cf13a2fdf380b101dcb25363010c38b2cf1bb364d095ed10fcecaa9e76a2caafc5b5c335d51f8d69d06e7bacecc62ce086b16cc4c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 1800 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1980 WerFault.exe
1980 WerFault.exe
1980 WerFault.exe
1980 WerFault.exe
1980 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1980 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1980 WerFault.exe

pid	pid_target	process	target process
1980	1800	WerFault.exe	regsvr32.exe

pid	process
1980	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1980	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1672 wrote to memory of 1800	1672	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 1800	1672	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 1800	1672	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 1800	1672	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 1800	1672	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 1800	1672	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 1800	1672	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 1980	1800	regsvr32.exe	WerFault.exe
PID 1800 wrote to memory of 1980	1800	regsvr32.exe	WerFault.exe
PID 1800 wrote to memory of 1980	1800	regsvr32.exe	WerFault.exe
PID 1800 wrote to memory of 1980	1800	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tirckBot_fixed_04D60000.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\tirckBot_fixed_04D60000.bin.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1800

memory/1672-60-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/1800-61-0x0000000000000000-mapping.dmp

Download
memory/1800-62-0x0000000075971000-0x0000000075973000-memory.dmp

Filesize
8KB

Download
memory/1980-63-0x0000000000000000-mapping.dmp

Download
memory/1980-64-0x00000000003F0000-0x0000000000450000-memory.dmp

Filesize
384KB

Download