dce920f5db90efecc7fb7a6b6399c80fc83e3f1251f160cd1295b6a4b67125d4

Analysis

Target

dce920f5db90efecc7fb7a6b6399c80fc83e3f1251f160cd1295b6a4b67125d4.dll
Size

159KB
MD5

e3dace173ded785a9af4a9007587eec6
SHA1

2b746a247ef14585e9102336939e341f62cc6b67
SHA256

dce920f5db90efecc7fb7a6b6399c80fc83e3f1251f160cd1295b6a4b67125d4
SHA512

da3c9481438b4373c328904aac1ed64a1d20c02a558573543b36fc35a1f296664b518243fe4431b8b19c85678271cc0e7215aae7dd3769d998a45297dccb3b25

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1996	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1996	1800	rundll32.exe	25
PID 1800 wrote to memory of 1996	1800	rundll32.exe	25
PID 1800 wrote to memory of 1996	1800	rundll32.exe	25
PID 1800 wrote to memory of 1996	1800	rundll32.exe	25
PID 1800 wrote to memory of 1996	1800	rundll32.exe	25
PID 1800 wrote to memory of 1996	1800	rundll32.exe	25
PID 1800 wrote to memory of 1996	1800	rundll32.exe	25
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dce920f5db90efecc7fb7a6b6399c80fc83e3f1251f160cd1295b6a4b67125d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dce920f5db90efecc7fb7a6b6399c80fc83e3f1251f160cd1295b6a4b67125d4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 224
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2012

memory/1996-61-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/2012-64-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download