25b317eee0f008753b9c9c2de0efec5976493b89d30d91a5a65a4bf32a4872ce

Analysis

Target

tmp/25b317eee0f008753b9c9c2de0efec5976493b89d30d91a5a65a4bf32a4872ce.exe.dll
Size

117KB
MD5

06d3cb4ee8904249183e9193654f3aa8
SHA1

fc8b81a18f0b8705ac695b1bdd47290ff0cf97f4
SHA256

25b317eee0f008753b9c9c2de0efec5976493b89d30d91a5a65a4bf32a4872ce
SHA512

3f53e742f1f1bd0ad42cf9c8c6ffc79153579194d3b378336a047097925b937d4d56859474a91381c5788d093b9389ad02685905057dde19841da7bf6e53ff95

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 1672 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

852 WerFault.exe
852 WerFault.exe
852 WerFault.exe
852 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

852 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 852 WerFault.exe

pid	pid_target	process	target process
852	1672	WerFault.exe	regsvr32.exe

pid	process
852	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	852	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1584 wrote to memory of 1672	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1672	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1672	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1672	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1672	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1672	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1672	1584	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 852	1672	regsvr32.exe	WerFault.exe
PID 1672 wrote to memory of 852	1672	regsvr32.exe	WerFault.exe
PID 1672 wrote to memory of 852	1672	regsvr32.exe	WerFault.exe
PID 1672 wrote to memory of 852	1672	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tmp\25b317eee0f008753b9c9c2de0efec5976493b89d30d91a5a65a4bf32a4872ce.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\tmp\25b317eee0f008753b9c9c2de0efec5976493b89d30d91a5a65a4bf32a4872ce.exe.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1672

memory/852-58-0x0000000000000000-mapping.dmp

Download
memory/852-59-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1584-55-0x000007FEFC3A1000-0x000007FEFC3A3000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000000000-mapping.dmp

Download
memory/1672-57-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download