a93c981b5b7501545df3d6aba5b76d7b312107a402a4e54521d009eb382ddc97

Analysis

Target
80811d2e39e6854db45247bfb9dd2d6a.dll
Size 162KB
Sample210603-7db2xxe8fs
SHA256 a93c981b5b7501545df3d6aba5b76d7b312107a402a4e54521d009eb382ddc97
MD5 80811d2e39e6854db45247bfb9dd2d6a
SHA1 717ea19d097530d2433c044ab4cad0a04769895d
SHA512 11e4b53cdc19b707ca3761e61a995aba46d4cd718c0d58e940dc3ec3c317ad06de76f7395cf6b43783297811a7bcf8e6e2428209b937933611348b2590220e8f
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	492	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 492	2988	rundll32.exe	70
PID 2988 wrote to memory of 492	2988	rundll32.exe	70
PID 2988 wrote to memory of 492	2988	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80811d2e39e6854db45247bfb9dd2d6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80811d2e39e6854db45247bfb9dd2d6a.dll,#1
  2⤵
  PID:492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 620
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3860