4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6

Analysis

Target

4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6.dll
Size

135KB
MD5

ef81a01e614a3a7c7a06171e8ec463b6
SHA1

499cceeeb6485b34233b85fdbd5e26397423f0a7
SHA256

4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6
SHA512

62f6dfe15b5b84ee773d0981de5a73734baeb8d7c6407959736387bed9e5655abfc62bc1febe67e6ea5176365ec0f8f8212cf177a4680c9236bf39cd546db9cd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	1916	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1960	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1916	1080	rundll32.exe	25
PID 1080 wrote to memory of 1916	1080	rundll32.exe	25
PID 1080 wrote to memory of 1916	1080	rundll32.exe	25
PID 1080 wrote to memory of 1916	1080	rundll32.exe	25
PID 1080 wrote to memory of 1916	1080	rundll32.exe	25
PID 1080 wrote to memory of 1916	1080	rundll32.exe	25
PID 1080 wrote to memory of 1916	1080	rundll32.exe	25
PID 1916 wrote to memory of 1960	1916	rundll32.exe	28
PID 1916 wrote to memory of 1960	1916	rundll32.exe	28
PID 1916 wrote to memory of 1960	1916	rundll32.exe	28
PID 1916 wrote to memory of 1960	1916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 224
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1960

memory/1916-61-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1960-64-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download