d72da7c54bce364b877de51e304ab6780744253ea6e78f3095e9bf2e2eef643b

Analysis

Target
a5d67349_by_Libranalysis.dll
Size 162KB
Sample210510-957dead7x2
SHA256 d72da7c54bce364b877de51e304ab6780744253ea6e78f3095e9bf2e2eef643b
MD5 a5d673491d6e1951b4f1d475a730d1e4
SHA1 b5cb904cb99e872800bfe973f26c619e11d617dc
SHA512 550b6ab8ef3b025d0be6b9307accc69a350c7db7731b9bc321d623b5fb91840a7dbdf4cd33088359ed7e389fab26bfa7d291d802d7233b3bd95c6b7af1e0da0f
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 800 created 4860	800	WerFault.exe	70

Program crash 1 IoCs

pid	pid_target	Process	procid_target
800	4860	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4860	4804	rundll32.exe	70
PID 4804 wrote to memory of 4860	4804	rundll32.exe	70
PID 4804 wrote to memory of 4860	4804	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5d67349_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5d67349_by_Libranalysis.dll,#1
  2⤵
  PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 592
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:800