2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b

Analysis

Target

2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll
Size

160KB
MD5

f782fa626b0c53d9cca2fbb29a65f23f
SHA1

9fabc6c255ea94262b6339e4b5949174afd30114
SHA256

2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b
SHA512

2d023aa899d5025631534489c6a13de071113f36ae2ab32d53c833c749d262019f3c3bd7961f2da12753e389bab92f4bda429662dec77552a13c825258af9e18

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	1876	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1184	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1876	1208	rundll32.exe	25
PID 1208 wrote to memory of 1876	1208	rundll32.exe	25
PID 1208 wrote to memory of 1876	1208	rundll32.exe	25
PID 1208 wrote to memory of 1876	1208	rundll32.exe	25
PID 1208 wrote to memory of 1876	1208	rundll32.exe	25
PID 1208 wrote to memory of 1876	1208	rundll32.exe	25
PID 1208 wrote to memory of 1876	1208	rundll32.exe	25
PID 1876 wrote to memory of 1184	1876	rundll32.exe	27
PID 1876 wrote to memory of 1184	1876	rundll32.exe	27
PID 1876 wrote to memory of 1184	1876	rundll32.exe	27
PID 1876 wrote to memory of 1184	1876	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 224
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1184

memory/1184-63-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1876-60-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download