43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf

Resubmissions

22/11/2021, 13:32

22/11/2021, 13:27

Target
5d3fa145fb26c55c03d3c2c48495251e.dll
Size 133KB
Sample211122-qs2p9afehp
SHA256 43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf
MD5 5d3fa145fb26c55c03d3c2c48495251e
SHA1 383fb47c582ec9375d03b97746cda9af5b93871e
SHA512 2cc20fc9cef78d7c960882dcb68c1c25ee843de9050795099f5d7d84e4cfabab4afa632ee06a2887530fb19a04b60580b97669a67e8c7b2e97374bf6147c00da
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
824	3304	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3304	3172	regsvr32.exe	68
PID 3172 wrote to memory of 3304	3172	regsvr32.exe	68
PID 3172 wrote to memory of 3304	3172	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d3fa145fb26c55c03d3c2c48495251e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d3fa145fb26c55c03d3c2c48495251e.dll
  2⤵
  PID:3304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 612
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:824