43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf

Resubmissions

22/11/2021, 13:32

22/11/2021, 13:27

Target
5d3fa145fb26c55c03d3c2c48495251e.dll
Size 133KB
Sample211122-qs2p9afehp
SHA256 43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf
MD5 5d3fa145fb26c55c03d3c2c48495251e
SHA1 383fb47c582ec9375d03b97746cda9af5b93871e
SHA512 2cc20fc9cef78d7c960882dcb68c1c25ee843de9050795099f5d7d84e4cfabab4afa632ee06a2887530fb19a04b60580b97669a67e8c7b2e97374bf6147c00da
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	764	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1292	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 764	524	regsvr32.exe	28
PID 524 wrote to memory of 764	524	regsvr32.exe	28
PID 524 wrote to memory of 764	524	regsvr32.exe	28
PID 524 wrote to memory of 764	524	regsvr32.exe	28
PID 524 wrote to memory of 764	524	regsvr32.exe	28
PID 524 wrote to memory of 764	524	regsvr32.exe	28
PID 524 wrote to memory of 764	524	regsvr32.exe	28
PID 764 wrote to memory of 1292	764	regsvr32.exe	29
PID 764 wrote to memory of 1292	764	regsvr32.exe	29
PID 764 wrote to memory of 1292	764	regsvr32.exe	29
PID 764 wrote to memory of 1292	764	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d3fa145fb26c55c03d3c2c48495251e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d3fa145fb26c55c03d3c2c48495251e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 296
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1292

memory/524-55-0x000007FEFBC51000-0x000007FEFBC53000-memory.dmp

Download

memory/764-57-0x0000000075B71000-0x0000000075B73000-memory.dmp

Download

memory/1292-60-0x0000000000640000-0x0000000000641000-memory.dmp

Download