24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0

Analysis

Target

24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll
Size

127KB
MD5

ee233e16958768992086207345e84556
SHA1

7647ac35b342f27ee51407ed63fa680b20b8fafb
SHA256

24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0
SHA512

a530d2533ae761a183404130372c4b06514c06224f491cdc5c32694c355413531d29ccc56e2ca6d4b47442fb4ffb5457d5ce53ee89a2a6f4e2a9d5c0a4252de3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	660	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 660	3700	rundll32.exe	71
PID 3700 wrote to memory of 660	3700	rundll32.exe	71
PID 3700 wrote to memory of 660	3700	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll,#1
  2⤵
  PID:660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 620
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2464