bf81fbbc09954cde0f6883a4f983b8f9623a9e126a242dacf7afeafcd156679d

Analysis

Target

ROGAIOSDK.dll
Size

334KB
MD5

ec24f3bce34b05b38c79627e93b432c4
SHA1

a2998092e224cf534728aeb88a523c82f6c041f9
SHA256

9699430ac09901f40e7b08d892b185959803a4a61fa0ec2e4e17b3ce48b78f28
SHA512

0a8d192bb12ade70ee71abaef37221b3adfa46c940b5e6668fad96cc1274eff27330f515acfc5e46358a7042ad446523989906a5ee077059016ce5588668bbfa

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1784 1556 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1784 WerFault.exe
1784 WerFault.exe
1784 WerFault.exe
1784 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1784 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1784 WerFault.exe

pid	pid_target	process	target process
1784	1556	WerFault.exe	rundll32.exe

pid	process
1784	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1784	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1276 wrote to memory of 1556	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1556	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1556	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1556	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1556	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1556	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1556	1276	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1784	1556	rundll32.exe	WerFault.exe
PID 1556 wrote to memory of 1784	1556	rundll32.exe	WerFault.exe
PID 1556 wrote to memory of 1784	1556	rundll32.exe	WerFault.exe
PID 1556 wrote to memory of 1784	1556	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ROGAIOSDK.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ROGAIOSDK.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1556

memory/1556-55-0x0000000000000000-mapping.dmp

Download
memory/1556-56-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1784-57-0x0000000000000000-mapping.dmp

Download
memory/1784-58-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download