50b3a811481295d5a9f00df228a89eb6bb56d99e313ba1fcfa4e1f606975cbc5

Analysis

Target

Datop/test.test.dll
Size

297KB
MD5

508fb618684f3dfb732d3aa8927c69ba
SHA1

475aa7d58b285565251935c4c5982ffdb188fe8a
SHA256

db0652616b6441bd7f45f9dcc7e3d2c2cd4d75df704c9a5c334b7e9c3acc2f2f
SHA512

861e24210c1027f53a9c0ea127f7d9f22978852c2e4adc7f43e3ff00f065b341b3130f1493c475a688800cbc4d3cf3627b5c15df988676c98de86d88827104b9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4304	2240	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 2240	3620	rundll32.exe	70
PID 3620 wrote to memory of 2240	3620	rundll32.exe	70
PID 3620 wrote to memory of 2240	3620	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Datop\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Datop\test.test.dll,#1
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 580
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4304