4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8

Analysis

Target

4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8.dll
Size

71KB
MD5

2683fc47adb5eb8336372c054bb88c76
SHA1

ee33902011ba8cee84b7677c4238ec74299b05eb
SHA256

4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8
SHA512

90bebc6356306e1700ec1b41f9a3785cef6861ae250344c12369957db4a63e063848fd7b76d9e7ef0fb7f6db56237ce67448c752749851da78e132cc52898e73

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3788	3644	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3644	4088	regsvr32.exe	69
PID 4088 wrote to memory of 3644	4088	regsvr32.exe	69
PID 4088 wrote to memory of 3644	4088	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8.dll
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 628
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3788