ef96cbd6fd2a0b7dca8fa51159a70324f31a528d08df57f5d4a2f7781fee353b

Analysis

Target
ee147584e2246a04dda55c3ed8f87fc5.dll
Size 215KB
Sample211207-tmdm1sbcbj
SHA256 ef96cbd6fd2a0b7dca8fa51159a70324f31a528d08df57f5d4a2f7781fee353b
MD5 ee147584e2246a04dda55c3ed8f87fc5
SHA1 80504e8b02d2d691dc0f6228f762646943cefd50
SHA512 e9cc5b105dac1e842e65b12a3fdcfc3217edd00ae31dc9c3da4dc49385833f5d959e2c468ff24b3598bd23ee413af1b54583406668a01295cd8a2a5a1a722ef4
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	3392	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3392	4056	regsvr32.exe	68
PID 4056 wrote to memory of 3392	4056	regsvr32.exe	68
PID 4056 wrote to memory of 3392	4056	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ee147584e2246a04dda55c3ed8f87fc5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ee147584e2246a04dda55c3ed8f87fc5.dll
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1764