e446b4ca910c3ff3b3add0fb35b3120385d880f7cf02ca21ba872e1d57eb39dd

Analysis

Target

e446b4ca910c3ff3b3add0fb35b3120385d880f7cf02ca21ba872e1d57eb39dd.bin.sample.dll
Size

8.3MB
MD5

cf903aa75574ea4b1be9c96a027203d3
SHA1

b9c5441919d9a247aa7449b354bb8c100665d23e
SHA256

e446b4ca910c3ff3b3add0fb35b3120385d880f7cf02ca21ba872e1d57eb39dd
SHA512

152dbd473d2277a95ec79a3d57f047ec8026617efc0117ad82d20102ca6a45c8ebb1a237fb0b0c0a40d5dee10c5f240cf946de73cdd11a523138270bad891b1f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 2004 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2028 WerFault.exe
2028 WerFault.exe
2028 WerFault.exe
2028 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2028 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2028 WerFault.exe

pid	pid_target	process	target process
2028	2004	WerFault.exe	rundll32.exe

pid	process
2028	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2028	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1028 wrote to memory of 2004	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 2004	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 2004	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 2004	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 2004	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 2004	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 2004	1028	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2028	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 2028	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 2028	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 2028	2004	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e446b4ca910c3ff3b3add0fb35b3120385d880f7cf02ca21ba872e1d57eb39dd.bin.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e446b4ca910c3ff3b3add0fb35b3120385d880f7cf02ca21ba872e1d57eb39dd.bin.sample.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2004

memory/2004-60-0x0000000000000000-mapping.dmp

Download
memory/2004-61-0x0000000076A01000-0x0000000076A03000-memory.dmp

Filesize
8KB

Download
memory/2028-62-0x0000000000000000-mapping.dmp

Download
memory/2028-63-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download