9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll
Size

488KB
MD5

8c778eded8caf98e71730b164b805e1b
SHA1

8f2180d092ac3b623d2372cb01eaccde0f5e402c
SHA256

24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365
SHA512

666aa5d99be4efa4a3a9c9021a116d8484e05120224c463b66246bf99f0d925a37b54c8e6902b7c7d8c7929c6748cc2ca45801525346de5bcef205a6fac33b18

Score

3^/10

Malware Config

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1052 3576 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1052	3576	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1052 WerFault.exe
Token: SeBackupPrivilege 1052 WerFault.exe
Token: SeDebugPrivilege 1052 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2068 wrote to memory of 3576	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 3576	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 3576	2068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll,#1
  2⤵
  PID:3576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 580
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1052