f99d1236a1f56745c2fcee8e97b464595c2d8af5caeec99a95532de28f74d055

Analysis

Target

tmp/f99d1236a1f56745c2fcee8e97b464595c2d8af5caeec99a95532de28f74d055.exe.dll
Size

132KB
MD5

1eabb6d464f7245f5a357600e5fbcdb2
SHA1

751c3e9c19fc62ead178f2554ef2c3965ff2b33f
SHA256

f99d1236a1f56745c2fcee8e97b464595c2d8af5caeec99a95532de28f74d055
SHA512

026cab0412480de005d4d0dd9177510a145b1658f2f3158bf91ab46d2cf303ebec553d4c4240b6e184891fc34c4987ea89f3856e68756e857a7fe8ec9fa1790c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

592 848 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

592 WerFault.exe
592 WerFault.exe
592 WerFault.exe
592 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

592 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 592 WerFault.exe

pid	pid_target	process	target process
592	848	WerFault.exe	rundll32.exe

pid	process
592	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	592	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 960 wrote to memory of 848	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 848	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 848	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 848	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 848	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 848	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 848	960	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 592	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 592	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 592	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 592	848	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tmp\f99d1236a1f56745c2fcee8e97b464595c2d8af5caeec99a95532de28f74d055.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tmp\f99d1236a1f56745c2fcee8e97b464595c2d8af5caeec99a95532de28f74d055.exe.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:848

memory/592-56-0x0000000000000000-mapping.dmp

Download
memory/592-58-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/848-54-0x0000000000000000-mapping.dmp

Download
memory/848-55-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download