e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727

Analysis

Target

e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll
Size

5KB
MD5

8ae40c8418b2c36b58d2a43153544ddd
SHA1

c5cc49b7b2cb30d19fa8fd7abff3a04d456f4b94
SHA256

e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727
SHA512

5b24f2fba4d5a25c6cfa8d1a422426c2c43a4032ecc2707bbdaf0d42deef48df95bbce2d12e0423c3569c5c8974a2c3b3a5fa39e86ffcac3372298de8e0304bb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4452	2616	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2616	3032	rundll32.exe	69
PID 3032 wrote to memory of 2616	3032	rundll32.exe	69
PID 3032 wrote to memory of 2616	3032	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll,#1
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4452