cf15e511906ceca3c0f9f67d36ba12880b52cb597f61d994e009f86c746aaa2f

Analysis

Target

21d0000.dll
Size

119KB
MD5

e49641855a12cdaaa15831ebe6455a8d
SHA1

06eb6a69cedd34403a9e684b3369dafe037a0d25
SHA256

cf15e511906ceca3c0f9f67d36ba12880b52cb597f61d994e009f86c746aaa2f
SHA512

45808595d8a8f6fe4adb9ca0c42c62fe68f972e867775f5d5c87d8e8d7bbdf99d066bb4609b43c86aa26399e286e3ac4b56ed25316a73386f6a12d1a9976d567

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1432 660 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

660 regsvr32.exe
1432 WerFault.exe
1432 WerFault.exe
1432 WerFault.exe
1432 WerFault.exe
1432 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1432 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1432 WerFault.exe

pid	pid_target	process	target process
1432	660	WerFault.exe	regsvr32.exe

pid	process
1432	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1432	WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1616 wrote to memory of 660	1616	regsvr32.exe	regsvr32.exe
PID 1616 wrote to memory of 660	1616	regsvr32.exe	regsvr32.exe
PID 1616 wrote to memory of 660	1616	regsvr32.exe	regsvr32.exe
PID 1616 wrote to memory of 660	1616	regsvr32.exe	regsvr32.exe
PID 1616 wrote to memory of 660	1616	regsvr32.exe	regsvr32.exe
PID 1616 wrote to memory of 660	1616	regsvr32.exe	regsvr32.exe
PID 1616 wrote to memory of 660	1616	regsvr32.exe	regsvr32.exe
PID 660 wrote to memory of 360	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 360	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 360	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 360	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 1432	660	regsvr32.exe	WerFault.exe
PID 660 wrote to memory of 1432	660	regsvr32.exe	WerFault.exe
PID 660 wrote to memory of 1432	660	regsvr32.exe	WerFault.exe
PID 660 wrote to memory of 1432	660	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\21d0000.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

memory/660-56-0x0000000000000000-mapping.dmp

Download
memory/660-57-0x0000000074F61000-0x0000000074F63000-memory.dmp

Filesize
8KB

Download
memory/1432-58-0x0000000000000000-mapping.dmp

Download
memory/1432-60-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/1616-55-0x000007FEFB831000-0x000007FEFB833000-memory.dmp

Filesize
8KB

Download