2b1a1f2cf9b95c22e02d7a707e5f436d9d4cfcf1db8a09ec1823d52c524c0838

Analysis

Target

742c0000.qScrollBar.dll
Size

117KB
MD5

e65b89698018208a7f95a9ab9b18ffa5
SHA1

8b7f008ec5c3b91f75c6cafd199a5f8dcd2d8049
SHA256

2b1a1f2cf9b95c22e02d7a707e5f436d9d4cfcf1db8a09ec1823d52c524c0838
SHA512

e198fbc78ce37b81ccdabcd20884eee59d939ff6bd0ab36df4ce36e97f60ff4bc1612a5dada8f3dd77b3377dea0fd9923b7526e308c5831c8e3ed0fb9057589d

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1224 1800 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1224 WerFault.exe
1224 WerFault.exe
1224 WerFault.exe
1224 WerFault.exe
1224 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1224 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1224 WerFault.exe

pid	pid_target	process	target process
1224	1800	WerFault.exe	rundll32.exe

pid	process
1224	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1224	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1748 wrote to memory of 1800	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1800	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1800	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1800	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1800	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1800	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1800	1748	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1224	1800	rundll32.exe	WerFault.exe
PID 1800 wrote to memory of 1224	1800	rundll32.exe	WerFault.exe
PID 1800 wrote to memory of 1224	1800	rundll32.exe	WerFault.exe
PID 1800 wrote to memory of 1224	1800	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\742c0000.qScrollBar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\742c0000.qScrollBar.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1800

memory/1224-61-0x0000000000000000-mapping.dmp

Download
memory/1224-63-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1800-59-0x0000000000000000-mapping.dmp

Download
memory/1800-60-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download