308d07fa6ea5a3e88f7bbdcbc5d7df86efb1c39c6736ab16059d88046c99933f

Analysis

Target

Oleacc.dll
Size

9.0MB
MD5

96e5dabb986d4a653ba7382f14e9f4af
SHA1

2af9c00f61fd821f7dbdbd222e2ca2b1652ecca7
SHA256

e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8
SHA512

6c37f8890ffe8a89d143e00a0e1368af1a43bd9d42025e185d879f61fe7307bce60c4055eab4da3a00cd1e13f1cb21b5b0548bae48087c960b49c3b7eb529878

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4080 3312 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4080	3312	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4080 WerFault.exe
Token: SeBackupPrivilege 4080 WerFault.exe
Token: SeDebugPrivilege 4080 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3696 wrote to memory of 3312	3696	rundll32.exe	rundll32.exe
PID 3696 wrote to memory of 3312	3696	rundll32.exe	rundll32.exe
PID 3696 wrote to memory of 3312	3696	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
  2⤵
  PID:3312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 732
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4080