43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf

Resubmissions

22/11/2021, 13:32

22/11/2021, 13:27

Target
5d3fa145fb26c55c03d3c2c48495251e.dll
Size 133KB
Sample211122-qs2p9afehp
SHA256 43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf
MD5 5d3fa145fb26c55c03d3c2c48495251e
SHA1 383fb47c582ec9375d03b97746cda9af5b93871e
SHA512 2cc20fc9cef78d7c960882dcb68c1c25ee843de9050795099f5d7d84e4cfabab4afa632ee06a2887530fb19a04b60580b97669a67e8c7b2e97374bf6147c00da
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	1444	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1940	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1444	876	regsvr32.exe	27
PID 876 wrote to memory of 1444	876	regsvr32.exe	27
PID 876 wrote to memory of 1444	876	regsvr32.exe	27
PID 876 wrote to memory of 1444	876	regsvr32.exe	27
PID 876 wrote to memory of 1444	876	regsvr32.exe	27
PID 876 wrote to memory of 1444	876	regsvr32.exe	27
PID 876 wrote to memory of 1444	876	regsvr32.exe	27
PID 1444 wrote to memory of 1940	1444	regsvr32.exe	29
PID 1444 wrote to memory of 1940	1444	regsvr32.exe	29
PID 1444 wrote to memory of 1940	1444	regsvr32.exe	29
PID 1444 wrote to memory of 1940	1444	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d3fa145fb26c55c03d3c2c48495251e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d3fa145fb26c55c03d3c2c48495251e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 296
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1940

C:\Windows\system32\taskeng.exe
taskeng.exe {5DA22874-DB88-4FCA-A017-5785302C332D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1720

memory/876-55-0x000007FEFB681000-0x000007FEFB683000-memory.dmp

Download

memory/1444-57-0x00000000754B1000-0x00000000754B3000-memory.dmp

Download

memory/1940-59-0x00000000022D0000-0x00000000022D1000-memory.dmp

Download