879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43

Analysis

Target

879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43.bin.dll
Size

5KB
MD5

8e7f03b83af062a85162c9dd0d54ca65
SHA1

e4d41a4a19b8f0b4b1ea64f4717bb731b5dec91e
SHA256

879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43
SHA512

57edae00449c60b0c6a60f32d8679f8051556de86fa3e46ce8c2e933ee272e289f2c9877973a22cb40ab9a0357affbd752f9336d3a31e051013484601336508a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3136	2848	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2848	2768	rundll32.exe	68
PID 2768 wrote to memory of 2848	2768	rundll32.exe	68
PID 2768 wrote to memory of 2848	2768	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43.bin.dll,#1
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3136