0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00

Resubmissions

07-07-2022 11:51

24-12-2021 14:23

24-12-2021 14:21

23-12-2021 13:06

Target

colorui.dll
Size

879KB
MD5

a91ba8f4a339a98fa94e810831e83d96
SHA1

871e52778597185f98eb0a57127024bcd094cf07
SHA256

0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00
SHA512

ac6fb57225f0765f40ee298e12d430d45e5d9b59f16742cb4c32f56b5663c244dad47d7c80a1919e09f4f9edc3ad0ac4645ee6aff9925c5d860651593f0b1a3e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
688	3712	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3712	3232	regsvr32.exe	69
PID 3232 wrote to memory of 3712	3232	regsvr32.exe	69
PID 3232 wrote to memory of 3712	3232	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\colorui.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\colorui.dll
  2⤵
  PID:3712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 660
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:688