ebab3a18bf406017dc2dec6f813b7cf7608b52d64365fd4d109149fb4a5801b0

Analysis

Target
c6f3494064e025c03826c7c9a41affa1.dll
Size 215KB
Sample211207-ve5bfabeek
SHA256 ebab3a18bf406017dc2dec6f813b7cf7608b52d64365fd4d109149fb4a5801b0
MD5 c6f3494064e025c03826c7c9a41affa1
SHA1 e46adfff34ef125c7bec7c32b6c1c982c93764ca
SHA512 088391062bcfe0fa8a13615dc221fb6522a0ac7d67574955c294b345a55480a7be294e48dd19287e4bf2e9af065e24ec38546041895f6b97d2578ff13797a2fe
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	2884	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2884	2680	regsvr32.exe	68
PID 2680 wrote to memory of 2884	2680	regsvr32.exe	68
PID 2680 wrote to memory of 2884	2680	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c6f3494064e025c03826c7c9a41affa1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c6f3494064e025c03826c7c9a41affa1.dll
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2276