bd94cd89740b1892257e1eda5c4ba04b1ac6d1c8aaa8bbfb7e0a46a4bac8eb2b

Analysis

Target

bd94cd89740b1892257e1eda5c4ba04b1ac6d1c8aaa8bbfb7e0a46a4bac8eb2b.sample.dll
Size

74KB
MD5

651cfe633c7ee0ea4d5f4d005bcaa207
SHA1

54b68a55196fe748b017b858f61987306a8f5252
SHA256

bd94cd89740b1892257e1eda5c4ba04b1ac6d1c8aaa8bbfb7e0a46a4bac8eb2b
SHA512

0a5cbcf9b36c5a33b471c806538d3274cc68ef39416b25205a18a9d49b3bfad7c17af0f7149e4267767dac0cddd3eac0420088f8498ca6d8ea78942b8ed7fa41

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1220 2020 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1220 WerFault.exe
1220 WerFault.exe
1220 WerFault.exe
1220 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1220 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1220 WerFault.exe

pid	pid_target	process	target process
1220	2020	WerFault.exe	rundll32.exe

pid	process
1220	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1220	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1116 wrote to memory of 2020	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 2020	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 2020	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 2020	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 2020	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 2020	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 2020	1116	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1220	2020	rundll32.exe	WerFault.exe
PID 2020 wrote to memory of 1220	2020	rundll32.exe	WerFault.exe
PID 2020 wrote to memory of 1220	2020	rundll32.exe	WerFault.exe
PID 2020 wrote to memory of 1220	2020	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd94cd89740b1892257e1eda5c4ba04b1ac6d1c8aaa8bbfb7e0a46a4bac8eb2b.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd94cd89740b1892257e1eda5c4ba04b1ac6d1c8aaa8bbfb7e0a46a4bac8eb2b.sample.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2020

memory/1220-61-0x0000000000000000-mapping.dmp

Download
memory/1220-62-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2020-59-0x0000000000000000-mapping.dmp

Download
memory/2020-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download