2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95

Analysis

Target

2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95.dll
Size

35KB
MD5

1bdf780ea6ff3abee41fe9f48d355592
SHA1

90177c060567990e289f746cd126975b9102d675
SHA256

2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95
SHA512

406a818310360996f8939c2f5e4728431cd077082b14e20e20b7257c235eb4d05f5a46e652f6ee00876a121050c94c4c983a992324ac68c2973abdcf514711fe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 1100 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2032 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2032 WerFault.exe

pid	pid_target	process	target process
2032	1100	WerFault.exe	rundll32.exe

pid	process
2032	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2032	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1100 wrote to memory of 2032	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 2032	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 2032	1100	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

memory/2032-60-0x0000000000000000-mapping.dmp

Download
memory/2032-61-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp

Filesize
8KB

Download
memory/2032-62-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download