4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6

Analysis

Target

4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6.dll
Size

135KB
MD5

ef81a01e614a3a7c7a06171e8ec463b6
SHA1

499cceeeb6485b34233b85fdbd5e26397423f0a7
SHA256

4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6
SHA512

62f6dfe15b5b84ee773d0981de5a73734baeb8d7c6407959736387bed9e5655abfc62bc1febe67e6ea5176365ec0f8f8212cf177a4680c9236bf39cd546db9cd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	1544	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1544	904	rundll32.exe	71
PID 904 wrote to memory of 1544	904	rundll32.exe	71
PID 904 wrote to memory of 1544	904	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6.dll,#1
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 620
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1672