64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb

Resubmissions

29-09-2021 16:05

21-09-2021 11:19

Target

test.test.dll
Size

439KB
MD5

22aef4558853a72dd07ff9513a6b9dbf
SHA1

52a914b43dfa44910ab649be77a57db631d038ee
SHA256

64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb
SHA512

550f72f4d6186869893b2dc6536b3ce9bcb7843b0db726a1d9fb118291b1e96d642dfb57369b85ff58c41b38d6c40f6853d1da752f589aa419cb1f4d35381be4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	3212	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3212	2176	rundll32.exe	70
PID 2176 wrote to memory of 3212	2176	rundll32.exe	70
PID 2176 wrote to memory of 3212	2176	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
  2⤵
  PID:3212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2736

memory/3212-116-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/3212-117-0x0000000003070000-0x0000000003084000-memory.dmp

Filesize
80KB

Download
memory/3212-118-0x00000000030A0000-0x00000000030B2000-memory.dmp

Filesize
72KB

Download