a84ce5f878d308a093823b638d997e9081a4aaae4ed8bfcad3372f99942de223

Analysis

Target
jjy.dll
Size 823KB
Sample210824-cmnln2jnnj
SHA256 a84ce5f878d308a093823b638d997e9081a4aaae4ed8bfcad3372f99942de223
MD5 28e594119e5081ef5504e241e4c72285
SHA1 794e8eae373570e15b563a0d3ae1ee042a64c313
SHA512 6f91135533ed3e5c2294abcf631cee5e2b2f775b491ed5ca142f290653993edddac471822c4c6d2323ea0babab6dd403b04e06fbe51fbe9111c051f11422c57d
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3576	3088	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3088	1852	rundll32.exe	70
PID 1852 wrote to memory of 3088	1852	rundll32.exe	70
PID 1852 wrote to memory of 3088	1852	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jjy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jjy.dll,#1
  2⤵
  PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3576

memory/3088-115-0x0000000000BD0000-0x0000000000BF3000-memory.dmp

Download

memory/3088-116-0x0000000000E00000-0x0000000000EAE000-memory.dmp

Download