31c043f56f0c911dfcb0208a87783bfbdbc46f9c145b62d4e36f5b80f049005f

Analysis

Target
5e9d56eb2c039e272e646e9fe7c6a7b2.dll
Size 1.4MB
Sample220113-1d79lacfek
SHA256 31c043f56f0c911dfcb0208a87783bfbdbc46f9c145b62d4e36f5b80f049005f
MD5 5e9d56eb2c039e272e646e9fe7c6a7b2
SHA1 9fda658aba2a52768669754328b09b5550d4855a
SHA512 a85f239d7ca00d2b42dec53155df26f559294008b858588861bca8d7f8f2278a007555f6398a6dd30461e85d3786616bf0d0c303ec24e3afeb65d6135f96f4cf
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3968	648	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 648	1816	regsvr32.exe	69
PID 1816 wrote to memory of 648	1816	regsvr32.exe	69
PID 1816 wrote to memory of 648	1816	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5e9d56eb2c039e272e646e9fe7c6a7b2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5e9d56eb2c039e272e646e9fe7c6a7b2.dll
  2⤵
  PID:648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 648
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3968