fd8237417d71c5c0d390bf8e5cfd4019843310c01262a90cb6de53dbc4d25312

Analysis

Target
SecuriteInfo.com.Variant.Fragtor.43252.2522.24833.dll
Size 449KB
Sample211203-e3n2cshed6
SHA256 fd8237417d71c5c0d390bf8e5cfd4019843310c01262a90cb6de53dbc4d25312
MD5 c22d8cdca3bf5286ed08414720218187
SHA1 eda18e76bcc1b06bed4a9e7bb5b86f1d749dff40
SHA512 10d097eb59e822ac67fccde95e95a9b5b77b727e4693ad3ee5a8b04aa46839cffec96e1e31ccaa3324749f9ebae4fcb6de6639014ba8d7bd6f9214d84372bc40
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3824	4472	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4472	4036	regsvr32.exe	69
PID 4036 wrote to memory of 4472	4036	regsvr32.exe	69
PID 4036 wrote to memory of 4472	4036	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Fragtor.43252.2522.24833.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Fragtor.43252.2522.24833.dll
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 636
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3824