a949023db784c4bbd82a2ce3d6957a457efb81dae684dd92bfd3b7fce3b8f679

Analysis

Target

Fate.Client.dll
Size

97KB
MD5

a52b01e495868f6d5c1ea8beba6e6d7d
SHA1

e1c5ab1dacb39f19a8edf0be1a2e301917bcfccb
SHA256

4fe8f52286ac4e6773b3cdea005c447da3a2e6ec13e0d76eead717eccd0b0028
SHA512

e3c83c361435da5071306d2bd2ef6a992a2d190d7bac2ccfe74f80a640759719aef707a0efee5fb06a891484f0e36497c27f5b3bfc47c52816163b0db0737e1d

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1372 872 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1372 WerFault.exe
1372 WerFault.exe
1372 WerFault.exe
1372 WerFault.exe
1372 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1372 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1372 WerFault.exe

pid	pid_target	process	target process
1372	872	WerFault.exe	rundll32.exe

pid	process
1372	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1372	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 872 wrote to memory of 1372	872	rundll32.exe	WerFault.exe
PID 872 wrote to memory of 1372	872	rundll32.exe	WerFault.exe
PID 872 wrote to memory of 1372	872	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fate.Client.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:872

memory/1372-55-0x0000000000000000-mapping.dmp

Download
memory/1372-56-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/1372-57-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download