b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d

Resubmissions

28/10/2021, 14:01

12/10/2021, 19:22

Target
triage_dropped_file.dll
Size 381KB
Sample211012-x2891sdbe7
SHA256 b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d
MD5 a025bf940882b77993185b7b9abe73ab
SHA1 973f4f28d656949862e0fc0e0e0f371858aa1da7
SHA512 1cf70df6a3c6a78e7f76b8f84b1b0751a10a85042d6b3011e4debdfedbce200c19dd5c5171fe43bebe34a1978b1a0e51813a06345b698fa4298ec46d9fca0684
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4180	4944	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4944	4652	regsvr32.exe	71
PID 4652 wrote to memory of 4944	4652	regsvr32.exe	71
PID 4652 wrote to memory of 4944	4652	regsvr32.exe	71

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4180

memory/4944-115-0x0000000000860000-0x00000000008A1000-memory.dmp

Download