412cfacac6a032dea81fd6e3543b0c409cebe6dd6902dca412b0128b8a54e195

Resubmissions

09-12-2021 17:56

07-12-2021 15:17

Target

412cfacac6a032dea81fd6e3543b0c409cebe6dd6902dca412b0128b8a54e195.dll
Size

215KB
MD5

7b1362870f12d494aae22c5e0946f0c8
SHA1

6cbda7514163ea5ca6164bc3ee138e38946df1c2
SHA256

412cfacac6a032dea81fd6e3543b0c409cebe6dd6902dca412b0128b8a54e195
SHA512

ebfaf702d6402ef7536c9f9b4b1c4bc8c06eaffccb662533fe74524f5487becfa0cd21786c31d16616507644469b5723d89773d2cebdda76e1d931da2f5d5917

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
428	2544	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2544	1788	regsvr32.exe	68
PID 1788 wrote to memory of 2544	1788	regsvr32.exe	68
PID 1788 wrote to memory of 2544	1788	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\412cfacac6a032dea81fd6e3543b0c409cebe6dd6902dca412b0128b8a54e195.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\412cfacac6a032dea81fd6e3543b0c409cebe6dd6902dca412b0128b8a54e195.dll
  2⤵
  PID:2544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:428