50b3a811481295d5a9f00df228a89eb6bb56d99e313ba1fcfa4e1f606975cbc5

Analysis

Target

Datop/test2.test.dll
Size

297KB
MD5

be3f95b2ff9a56376525fa48c9db1553
SHA1

f3db37da2369b083f8828bc8ba5ac4c7232983d4
SHA256

868246c1861a22c681d47fdc102215a9c9f7551985f6abcbfb7b983f1cffadbe
SHA512

2ea4b718f870d509c5e2b51954fefe4e916f705f7820963e37e14f7285612beca2c78181a9ba016855d08c74b51ef5d002d0da79b9dde0a82dccc1a83f67e59f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	916	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 916	808	rundll32.exe	68
PID 808 wrote to memory of 916	808	rundll32.exe	68
PID 808 wrote to memory of 916	808	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Datop\test2.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Datop\test2.test.dll,#1
  2⤵
  PID:916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 580
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1052