9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
Size

1.4MB
MD5

c00e0c5f7cf5ca5a1ecaf2f52cb0fe3f
SHA1

943f28aaad96f667c5afc9480f14f06701b6faf1
SHA256

67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce
SHA512

685b3472e5a9f11fa21bc21b4c213256aaa23ed12db109ceb410f018df4e24114628ae9c6088d43e438d8f756f18dcad83797ee39562eb17c0131f1aa4133078

Score

3^/10

Malware Config

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3104	3852	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 3852	1840	regsvr32.exe	69
PID 1840 wrote to memory of 3852	1840	regsvr32.exe	69
PID 1840 wrote to memory of 3852	1840	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3104