cf15e511906ceca3c0f9f67d36ba12880b52cb597f61d994e009f86c746aaa2f

Analysis

Target

cf15e511906ceca3c0f9f67d36ba12880b52cb597f61d994e009f86c746aaa2f.dll
Size

119KB
MD5

e49641855a12cdaaa15831ebe6455a8d
SHA1

06eb6a69cedd34403a9e684b3369dafe037a0d25
SHA256

cf15e511906ceca3c0f9f67d36ba12880b52cb597f61d994e009f86c746aaa2f
SHA512

45808595d8a8f6fe4adb9ca0c42c62fe68f972e867775f5d5c87d8e8d7bbdf99d066bb4609b43c86aa26399e286e3ac4b56ed25316a73386f6a12d1a9976d567

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1128 1092 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

1092 regsvr32.exe
1128 WerFault.exe
1128 WerFault.exe
1128 WerFault.exe
1128 WerFault.exe
1128 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1128 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1128 WerFault.exe

pid	pid_target	process	target process
1128	1092	WerFault.exe	regsvr32.exe

pid	process
1128	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1128	WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1116 wrote to memory of 1092	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1092	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1092	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1092	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1092	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1092	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1092	1116	regsvr32.exe	regsvr32.exe
PID 1092 wrote to memory of 1748	1092	regsvr32.exe	explorer.exe
PID 1092 wrote to memory of 1748	1092	regsvr32.exe	explorer.exe
PID 1092 wrote to memory of 1748	1092	regsvr32.exe	explorer.exe
PID 1092 wrote to memory of 1748	1092	regsvr32.exe	explorer.exe
PID 1092 wrote to memory of 1128	1092	regsvr32.exe	WerFault.exe
PID 1092 wrote to memory of 1128	1092	regsvr32.exe	WerFault.exe
PID 1092 wrote to memory of 1128	1092	regsvr32.exe	WerFault.exe
PID 1092 wrote to memory of 1128	1092	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf15e511906ceca3c0f9f67d36ba12880b52cb597f61d994e009f86c746aaa2f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

memory/1092-56-0x0000000000000000-mapping.dmp

Download
memory/1092-57-0x0000000076231000-0x0000000076233000-memory.dmp

Filesize
8KB

Download
memory/1116-55-0x000007FEFBB91000-0x000007FEFBB93000-memory.dmp

Filesize
8KB

Download
memory/1128-58-0x0000000000000000-mapping.dmp

Download
memory/1128-59-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download