cab0ed3b5e33786e84b488dcfce69f74c57e386b3a3670d508dcdba6ee3c8413

Analysis

Target
ca28785a3d0ba6cfef713780e0649b73.dll
Size 1.4MB
Sample220113-1d8v5acfel
SHA256 cab0ed3b5e33786e84b488dcfce69f74c57e386b3a3670d508dcdba6ee3c8413
MD5 ca28785a3d0ba6cfef713780e0649b73
SHA1 11a0f5b6cc12f0c4ae85d66a18800c5c49ab5311
SHA512 fa5299950eb8f63fb7a65a90c63fa03c792376940b70209afd8bde86426d54142a1dae2fc3609d015382f2b05cfb40a661b4d7e2574ba3a48c0b10b3d387cd39
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2836	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2836	3312	regsvr32.exe	69
PID 3312 wrote to memory of 2836	3312	regsvr32.exe	69
PID 3312 wrote to memory of 2836	3312	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca28785a3d0ba6cfef713780e0649b73.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ca28785a3d0ba6cfef713780e0649b73.dll
  2⤵
  PID:2836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 652
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2328