b67d3cbfb9178eb08748ba668659d97da4b395ac1ab7baa00e6d18da0206610e

Analysis

Target

b67d3cbfb9178eb08748ba668659d97da4b395ac1ab7baa00e6d18da0206610e.bin.dll
Size

5KB
MD5

9f6130643d0dc2ba95d54a5d62e033ba
SHA1

0b2cc24e56c5d8fcd1234b9d1867cff458b4ae16
SHA256

b67d3cbfb9178eb08748ba668659d97da4b395ac1ab7baa00e6d18da0206610e
SHA512

d43361d870bec733ba3a17b06dcf4497dc3e050de900d8d63d3dc4c63f95bcfb21cb0df465eb0dbb07a36c02551d6f43541cd55861a4abdb91f8fd44481ec4a6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4084	3544	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3544	3436	rundll32.exe	68
PID 3436 wrote to memory of 3544	3436	rundll32.exe	68
PID 3436 wrote to memory of 3544	3436	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b67d3cbfb9178eb08748ba668659d97da4b395ac1ab7baa00e6d18da0206610e.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b67d3cbfb9178eb08748ba668659d97da4b395ac1ab7baa00e6d18da0206610e.bin.dll,#1
  2⤵
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4084