a949023db784c4bbd82a2ce3d6957a457efb81dae684dd92bfd3b7fce3b8f679

Analysis

Target

Fate.Client.dll
Size

97KB
MD5

5705ccb66070bc51c725a307518d5794
SHA1

f3c2d1fa1c238052c5e926d406c32081931b4aad
SHA256

d835bb2d1a3a6df132dee97de30358ad2853fd1b3f329c7d8eb2090c59b30828
SHA512

f53429d9a1ad0716de99ecdcfa551d9bec4a92c401cc7cf525f31d74951e32045d4e1f968dfa77189106a2eae267d4c4d238ccc6892f0fa2dabaf6135c5edde1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

460 1524 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

460 WerFault.exe
460 WerFault.exe
460 WerFault.exe
460 WerFault.exe
460 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

460 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 460 WerFault.exe

pid	pid_target	process	target process
460	1524	WerFault.exe	rundll32.exe

pid	process
460	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	460	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1524 wrote to memory of 460	1524	rundll32.exe	WerFault.exe
PID 1524 wrote to memory of 460	1524	rundll32.exe	WerFault.exe
PID 1524 wrote to memory of 460	1524	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fate.Client.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

memory/460-55-0x0000000000000000-mapping.dmp

Download
memory/460-56-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

Filesize
8KB

Download
memory/460-57-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download