dd2080084af2ebe00aaacf9dc0a7346cd66ba7121c662ae5f7520cf2d7c28bee

Analysis

Target
dad575f7_by_Libranalysis.dll
Size 162KB
Sample210508-tbrgrrtn7s
SHA256 dd2080084af2ebe00aaacf9dc0a7346cd66ba7121c662ae5f7520cf2d7c28bee
MD5 dad575f7d245ca56814963e2c86f3205
SHA1 09b469540459ca65406df57ca82bf9c24f1835d8
SHA512 7c2376623e3a2f74d675991451aa91e1a37deddaf0c38fc177b94c53f03fadccb8834ca34cfd21187d6bac70b632f41c7c38ad26d6a6c7bb0d84da0184e0233d
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3844	2240	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2240	2672	rundll32.exe	68
PID 2672 wrote to memory of 2240	2672	rundll32.exe	68
PID 2672 wrote to memory of 2240	2672	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dad575f7_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dad575f7_by_Libranalysis.dll,#1
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3844