afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc

Analysis

Target
sep2.dll
Size 3.0MB
Sample210628-6sa2hcet86
SHA256 afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc
MD5 24fb3fd5b93f3b94032982fa355480bd
SHA1 f7255a24af4304d18986a9d019ddb85d5dd09bea
SHA512 859afabfd8ccf1e63bb8d0d1e64da860cf82d91ced5a0f43b7443bec64b47208019c1b27738443f863d3a95d70d7f4cebf2b7c9b396471d984693e121d0bdff9
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
528	1484	WerFault.exe	74

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1484	1704	regsvr32.exe	74
PID 1704 wrote to memory of 1484	1704	regsvr32.exe	74
PID 1704 wrote to memory of 1484	1704	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\sep2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\sep2.dll
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 628
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:528

memory/1484-115-0x0000000010000000-0x0000000010037000-memory.dmp

Download

memory/1484-116-0x0000000004C10000-0x0000000004C53000-memory.dmp

Download