64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb

Resubmissions

29/09/2021, 16:05

21/09/2021, 11:19

Target
test.test.dll
Size 439KB
Sample210921-net25shcf9
SHA256 64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb
MD5 22aef4558853a72dd07ff9513a6b9dbf
SHA1 52a914b43dfa44910ab649be77a57db631d038ee
SHA512 550f72f4d6186869893b2dc6536b3ce9bcb7843b0db726a1d9fb118291b1e96d642dfb57369b85ff58c41b38d6c40f6853d1da752f589aa419cb1f4d35381be4
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	3212	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3212	2176	rundll32.exe	70
PID 2176 wrote to memory of 3212	2176	rundll32.exe	70
PID 2176 wrote to memory of 3212	2176	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
  2⤵
  PID:3212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2736

memory/3212-116-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/3212-117-0x0000000003070000-0x0000000003084000-memory.dmp

Download

memory/3212-118-0x00000000030A0000-0x00000000030B2000-memory.dmp

Download