34614187ce317f6d035d659e9d0d1c103942dc668262e590a0ee695840a1d1ff

Analysis

Target

74510000.qInconsistentFormula.dll
Size

117KB
MD5

d6eb22ed48708bbacbbf1a479024c4e8
SHA1

bd63c1735c2382a342320adde50f39f38a94dca7
SHA256

34614187ce317f6d035d659e9d0d1c103942dc668262e590a0ee695840a1d1ff
SHA512

1fc421a03c07be168dc0e0d6519775a4363898dfcfc1debb793db20647dd8bea13dda4bfc270568140ad78a736cfbf3fb0d886d9f9f95fa4615a9947ea3afd30

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1652 1336 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1652 WerFault.exe
1652 WerFault.exe
1652 WerFault.exe
1652 WerFault.exe
1652 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1652 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1652 WerFault.exe

pid	pid_target	process	target process
1652	1336	WerFault.exe	rundll32.exe

pid	process
1652	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1652	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1420 wrote to memory of 1336	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1336	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1336	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1336	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1336	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1336	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1336	1420	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1652	1336	rundll32.exe	WerFault.exe
PID 1336 wrote to memory of 1652	1336	rundll32.exe	WerFault.exe
PID 1336 wrote to memory of 1652	1336	rundll32.exe	WerFault.exe
PID 1336 wrote to memory of 1652	1336	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74510000.qInconsistentFormula.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74510000.qInconsistentFormula.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1336

memory/1336-60-0x0000000000000000-mapping.dmp

Download
memory/1336-61-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1652-62-0x0000000000000000-mapping.dmp

Download
memory/1652-64-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download