306d564fba556c9db12269b01bdadb3eba19e43c60f180c6f41a72a1fc9840d3

Analysis

Target
B2.dll
Size 654KB
Sample210803-avy934bcf2
SHA256 306d564fba556c9db12269b01bdadb3eba19e43c60f180c6f41a72a1fc9840d3
MD5 d7c87a735968d424d5c0aa2794d23657
SHA1 957a6ef9961e71d0207c5ab2ccc153b41f73e110
SHA512 5ef0e40f059cb752421af3123deef73df4544fe1653efdfdfa277ed879d06f6eb6d6ff5234ae159746f2dc9bbc167273851c1a14ace3f38bcd1661828b0e35d5
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3740	1604	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1604	3492	rundll32.exe	70
PID 3492 wrote to memory of 1604	3492	rundll32.exe	70
PID 3492 wrote to memory of 1604	3492	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\B2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\B2.dll,#1
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 656
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3740

memory/1604-115-0x0000000003200000-0x000000000334A000-memory.dmp

Download

memory/1604-116-0x0000000003200000-0x000000000334A000-memory.dmp

Download