eb3788ccc4955c642f2bfc4103f3f379aec3d51491a8e43083c7a8c16c613a83

Analysis

Target

182c9120000.dll
Size

94KB
MD5

f1779294b74be447f0716c43f13be745
SHA1

bbc41fb01c630237c4afafd39b7399e2b5c6c15c
SHA256

eb3788ccc4955c642f2bfc4103f3f379aec3d51491a8e43083c7a8c16c613a83
SHA512

876a1b20250ac3166833f84929b8a865a9e6801bd48855f194f61cea9838ac2b597a017c878b5f1ab8ef0bc7b7df7db44f015ec4bedcbc3ec5593d050960f1a2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 2004 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1740 WerFault.exe
1740 WerFault.exe
1740 WerFault.exe
1740 WerFault.exe
1740 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1740 WerFault.exe

pid	pid_target	process	target process
1740	2004	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1740	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 1740	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 1740	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 1740	2004	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\182c9120000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

memory/1740-52-0x0000000000000000-mapping.dmp

Download
memory/1740-53-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmp

Filesize
8KB

Download
memory/1740-54-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download