d36820a2a6f957fe2cfefabef255a96e0a430e2fe9cbe25e1fcb006b24398a27

Analysis

Target
517d29a67e8b4ee8d819eacc6d6ad915.dll
Size 449KB
Sample211204-eynvssadck
SHA256 d36820a2a6f957fe2cfefabef255a96e0a430e2fe9cbe25e1fcb006b24398a27
MD5 517d29a67e8b4ee8d819eacc6d6ad915
SHA1 4dc289f7130b122210a8a13a7c33b258ac3a6c84
SHA512 cc5a43c4c8f4325168416a219180675777c665ec970cde073fec8eef0e0e3245d0a7579fcce640e49c1dfd062b128cb7a484c3f9f91c97604ae68d23040650a6
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
500	2712	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2712	2396	regsvr32.exe	68
PID 2396 wrote to memory of 2712	2396	regsvr32.exe	68
PID 2396 wrote to memory of 2712	2396	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\517d29a67e8b4ee8d819eacc6d6ad915.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\517d29a67e8b4ee8d819eacc6d6ad915.dll
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 624
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:500