f745ae59b8e4c4c5d5d0872b86168bc8c82fef459bd2303993ac166cbe79acf9

Analysis

Target

10000000.bcdf.dll
Size

50KB
MD5

4d4be2544b2e0a61beac5371a7695e04
SHA1

fabc2d4e221280b53a57814beb8b44d73855d4d6
SHA256

f745ae59b8e4c4c5d5d0872b86168bc8c82fef459bd2303993ac166cbe79acf9
SHA512

bcd9094363ea96d50530609a14cbeebd6db6e3ff285fd2556a6a11d7645244bb8da15848803a666931dde48cf93a94a238c1d16b778fccd6255bd6c5f20d83a3

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1032 created 900	1032	WerFault.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1032	900	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 900	752	regsvr32.exe	68
PID 752 wrote to memory of 900	752	regsvr32.exe	68
PID 752 wrote to memory of 900	752	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\10000000.bcdf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\10000000.bcdf.dll
  2⤵
  PID:900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 616
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1032