b5c188e82a1dad02f71fcb40783cd8b910ba886acee12f7f74c73ed310709cd2

Analysis

Target
b5c188e82a1dad02f71fcb40783cd8b910ba886acee12f7f74c73ed310709cd2.bin.dll
Size 228KB
Sample211224-xtsbjafah3
SHA256 b5c188e82a1dad02f71fcb40783cd8b910ba886acee12f7f74c73ed310709cd2
MD5 41b279fa879354ce8a47970758efe40a
SHA1 eeecdd240ae03ffb38445d887418d63bf31bc2bc
SHA512 a6924a8df337f529eefd1eec5e9d17c3ffa720063ab21fa663bedc748dac9ced31c2f405bd0236f53456e18f7eac68d479b7a46dfb8d5286a3e268b1d88577cd
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
572	2752	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2752	2724	rundll32.exe	69
PID 2724 wrote to memory of 2752	2724	rundll32.exe	69
PID 2724 wrote to memory of 2752	2724	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5c188e82a1dad02f71fcb40783cd8b910ba886acee12f7f74c73ed310709cd2.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5c188e82a1dad02f71fcb40783cd8b910ba886acee12f7f74c73ed310709cd2.bin.dll,#1
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 700
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:572

memory/2752-116-0x0000000073B90000-0x0000000073BCE000-memory.dmp

Download

memory/2752-119-0x0000000000AC0000-0x0000000000AE3000-memory.dmp

Download