91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9

Analysis

Target

msvcp100.dll
Size

411KB
MD5

e3c817f7fe44cc870ecdbcbc3ea36132
SHA1

2ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA256

d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
SHA512

4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1368 1440 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1368 WerFault.exe
1368 WerFault.exe
1368 WerFault.exe
1368 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1368 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1368 WerFault.exe

pid	pid_target	process	target process
1368	1440	WerFault.exe	rundll32.exe

pid	process
1368	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1368	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1888 wrote to memory of 1440	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1440	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1440	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1440	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1440	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1440	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1440	1888	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 1368	1440	rundll32.exe	WerFault.exe
PID 1440 wrote to memory of 1368	1440	rundll32.exe	WerFault.exe
PID 1440 wrote to memory of 1368	1440	rundll32.exe	WerFault.exe
PID 1440 wrote to memory of 1368	1440	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp100.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp100.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1440

memory/1368-62-0x0000000000000000-mapping.dmp

Download
memory/1368-63-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1440-60-0x0000000000000000-mapping.dmp

Download
memory/1440-61-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download