24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0

Analysis

Target

24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll
Size

127KB
MD5

ee233e16958768992086207345e84556
SHA1

7647ac35b342f27ee51407ed63fa680b20b8fafb
SHA256

24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0
SHA512

a530d2533ae761a183404130372c4b06514c06224f491cdc5c32694c355413531d29ccc56e2ca6d4b47442fb4ffb5457d5ce53ee89a2a6f4e2a9d5c0a4252de3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
816	2020	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
816	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2020	1852	rundll32.exe	25
PID 1852 wrote to memory of 2020	1852	rundll32.exe	25
PID 1852 wrote to memory of 2020	1852	rundll32.exe	25
PID 1852 wrote to memory of 2020	1852	rundll32.exe	25
PID 1852 wrote to memory of 2020	1852	rundll32.exe	25
PID 1852 wrote to memory of 2020	1852	rundll32.exe	25
PID 1852 wrote to memory of 2020	1852	rundll32.exe	25
PID 2020 wrote to memory of 816	2020	rundll32.exe	27
PID 2020 wrote to memory of 816	2020	rundll32.exe	27
PID 2020 wrote to memory of 816	2020	rundll32.exe	27
PID 2020 wrote to memory of 816	2020	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 224
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:816

memory/816-63-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2020-60-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download