22068c7cbb40c3149b694b5fca1675d95e7e12509b36fa37350c194737c6c1f9

Analysis

Target
37e26534b70abd664cfed4961ad6ecbf.dll
Size 672KB
Sample210816-86cp8fzgra
SHA256 22068c7cbb40c3149b694b5fca1675d95e7e12509b36fa37350c194737c6c1f9
MD5 37e26534b70abd664cfed4961ad6ecbf
SHA1 a61cda70371db1c12965c236bb485392df957ce7
SHA512 2f59388e45cb7169bcc0d5c380ba55213070c219b35ec9d78fcd6238aff6177a4800b71eb32c301a86b6d56819010acfe7e4f0003e2a2cc15ea5ad2333a47e1f
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3596	824	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 824	3728	regsvr32.exe	72
PID 3728 wrote to memory of 824	3728	regsvr32.exe	72
PID 3728 wrote to memory of 824	3728	regsvr32.exe	72

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\37e26534b70abd664cfed4961ad6ecbf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\37e26534b70abd664cfed4961ad6ecbf.dll
  2⤵
  PID:824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 652
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3596

memory/824-116-0x0000000004460000-0x00000000044A4000-memory.dmp

Download

memory/824-115-0x0000000002840000-0x0000000002878000-memory.dmp

Download