04c8d0427fba79b1c0e640c473441ff6503657749b1709ee85f0912fb6ba3448

Analysis

Target

04c8d0-8sDqomArlxY5SzhKWD7x6QXAZjojt.dll
Size

172KB
MD5

ffd349bb84a19f1e9b9d6e68c63170cc
SHA1

ed19130acf6c9f930522f9c0caed53dd0f2523c3
SHA256

04c8d0427fba79b1c0e640c473441ff6503657749b1709ee85f0912fb6ba3448
SHA512

df7d731f45ecbdff19823a5c487d20cb78c97f400cd0895aaf52f9667b5fe3966a57a9928ab2a47667187e66b7cae3e39c36d06ad0c81f3a7a8007a335b2a078

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

952 1660 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

952 WerFault.exe
952 WerFault.exe
952 WerFault.exe
952 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

952 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 952 WerFault.exe

pid	pid_target	process	target process
952	1660	WerFault.exe	rundll32.exe

pid	process
952	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	952	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1576 wrote to memory of 1660	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 1660	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 1660	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 1660	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 1660	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 1660	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 1660	1576	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 952	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 952	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 952	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 952	1660	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04c8d0-8sDqomArlxY5SzhKWD7x6QXAZjojt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04c8d0-8sDqomArlxY5SzhKWD7x6QXAZjojt.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1660

memory/952-57-0x0000000000000000-mapping.dmp

Download
memory/952-58-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/1660-55-0x0000000000000000-mapping.dmp

Download
memory/1660-56-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download