d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0

Analysis

Target

d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0.dll
Size

135KB
MD5

2512bc611f3477627381e7b69fd3dfc0
SHA1

4de71f730b57d672c3ccc9a655fd9e347b5462f9
SHA256

d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0
SHA512

ec71f2e14f38fd1aa8956ff38417cefbbebf35d2b79f70ac242f946cc7870a99c06329ee142a7fdc6c47e7ba27461065db38747eacf309b265d495c8e9b032f7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1384	3460	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3460	3916	rundll32.exe	69
PID 3916 wrote to memory of 3460	3916	rundll32.exe	69
PID 3916 wrote to memory of 3460	3916	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0.dll,#1
  2⤵
  PID:3460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 620
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1384