91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9

Analysis

Target

GdiPlus.dll
Size

1.6MB
MD5

a49decbfaf009c82e5e414f885f181f0
SHA1

33e718389544dcb4cb645641e4f6d8591707cda6
SHA256

085696538c772e4a09449a3046293a59b6a72fc096d777c47511285ae5e53b80
SHA512

e267ecd74de5c4259dc4fa8214bda73c9b8a1f090032a411dfd4514c3b99fef40d77faaea1716d1bdb91a16b5aca085fc603d7b708c417e3f938274416a4ed3e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1252 1316 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1252 WerFault.exe
1252 WerFault.exe
1252 WerFault.exe
1252 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1252 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1252 WerFault.exe

pid	pid_target	process	target process
1252	1316	WerFault.exe	rundll32.exe

pid	process
1252	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1252	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1648 wrote to memory of 1316	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1316	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1316	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1316	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1316	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1316	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1316	1648	rundll32.exe	rundll32.exe
PID 1316 wrote to memory of 1252	1316	rundll32.exe	WerFault.exe
PID 1316 wrote to memory of 1252	1316	rundll32.exe	WerFault.exe
PID 1316 wrote to memory of 1252	1316	rundll32.exe	WerFault.exe
PID 1316 wrote to memory of 1252	1316	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GdiPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GdiPlus.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1316

memory/1252-62-0x0000000000000000-mapping.dmp

Download
memory/1252-64-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1316-60-0x0000000000000000-mapping.dmp

Download
memory/1316-61-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download