62ea4a0e0ad8fa3b025a5eb6a6ef0e74972ee8f4ca55be901d4badbf6d60d6e8

Analysis

Target
cfd3cca091137b88f3eac109796ebaaa.dll
Size 267KB
Sample211201-rf5f2scgcr
SHA256 62ea4a0e0ad8fa3b025a5eb6a6ef0e74972ee8f4ca55be901d4badbf6d60d6e8
MD5 cfd3cca091137b88f3eac109796ebaaa
SHA1 8ed3c5fa47bbae34c0bd92939f20b1f868f156c7
SHA512 13251c623920e23a2df90c2595cccc01ec041962893719e5d11d454a459d3e56d4fb5bcdf2d4ab19e857f99b0204b23610d7d6bb86e01393656f52c8780b3695
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4560	4488	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4488	1860	rundll32.exe	69
PID 1860 wrote to memory of 4488	1860	rundll32.exe	69
PID 1860 wrote to memory of 4488	1860	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfd3cca091137b88f3eac109796ebaaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfd3cca091137b88f3eac109796ebaaa.dll,#1
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 584
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4560