ecebd962cd96072dbe852befb2ee4fec6d25e330c63349dabdc4f279b21d7027

Resubmissions

09/12/2021, 09:40

08/12/2021, 23:38

Target
796728076326f8c747578b0284dd079f.dll
Size 410KB
Sample211208-3mp6gsbcdk
SHA256 ecebd962cd96072dbe852befb2ee4fec6d25e330c63349dabdc4f279b21d7027
MD5 796728076326f8c747578b0284dd079f
SHA1 9e1091a8a1b28f591bddfcf52e542827611d444b
SHA512 6ae214dd8a5c3b672094099644777dc73ab24908503792209f4ab9d42d91c5240fb699e90c6887fd6a57048d0767930125b0ad0c1c22e871f787c42e7a02d5d6
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	776	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 776	3476	regsvr32.exe	68
PID 3476 wrote to memory of 776	3476	regsvr32.exe	68
PID 3476 wrote to memory of 776	3476	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\796728076326f8c747578b0284dd079f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\796728076326f8c747578b0284dd079f.dll
  2⤵
  PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1144

memory/776-116-0x0000000003050000-0x0000000003092000-memory.dmp

Download