fcbb7962f84b09a24c325e2e449daca5adbe19589dcec0a306442838e7ea374f

Analysis

Target

fcbb7962f84b09a24c325e2e449daca5adbe19589dcec0a306442838e7ea374f.dll
Size

267KB
MD5

5ca9ab3286c2536d4621c2617b265bef
SHA1

0cbd3f2e62f19a7fb8a2423304e16710ace3b51e
SHA256

fcbb7962f84b09a24c325e2e449daca5adbe19589dcec0a306442838e7ea374f
SHA512

d378ae116438c49ff49939d38aec5e440162c32395d42e4f21aa2df61b73e907ae9f1cbc25e523a6d13868da9f75ba808a02de1a7e13d165604e75a05533b301

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3332	696	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 696	3508	rundll32.exe	68
PID 3508 wrote to memory of 696	3508	rundll32.exe	68
PID 3508 wrote to memory of 696	3508	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcbb7962f84b09a24c325e2e449daca5adbe19589dcec0a306442838e7ea374f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcbb7962f84b09a24c325e2e449daca5adbe19589dcec0a306442838e7ea374f.dll,#1
  2⤵
  PID:696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 584
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3332