b6149807f9c7c1c84009208e0b25d1b00945150fe5de42a828870973194459cb

Analysis

Target

b6149807f9c7c1c84009208e0b25d1b00945150fe5de42a828870973194459cb.dll
Size

50KB
MD5

904d5e65ee31852db764d1b0bb92e1b1
SHA1

b58e65a8385ee5fab36a4913033b67e6d9dae83d
SHA256

b6149807f9c7c1c84009208e0b25d1b00945150fe5de42a828870973194459cb
SHA512

f2bd6fa02c7a4a7dbc936ad861a4f4cc8b99ee77434ff459b8718fcf918cda57881a5d19496af4ced2cacaad76229e0fd8efc0ef413428fdad8d3fcb83e104e2

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 868 created 952	868	WerFault.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	952	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 952	1388	regsvr32.exe	69
PID 1388 wrote to memory of 952	1388	regsvr32.exe	69
PID 1388 wrote to memory of 952	1388	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b6149807f9c7c1c84009208e0b25d1b00945150fe5de42a828870973194459cb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b6149807f9c7c1c84009208e0b25d1b00945150fe5de42a828870973194459cb.dll
  2⤵
  PID:952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 612
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:868