e592747f806e94d779ab7e1f888f99b068b609ee1a1c8da9664bce42a6df21a1

Analysis

Target
e592747f806e94d779ab7e1f888f99b068b609ee1a1c8da9664bce42a6df21a1.dll
Size 164KB
Sample220124-a59nmaghfr
SHA256 e592747f806e94d779ab7e1f888f99b068b609ee1a1c8da9664bce42a6df21a1
MD5 f3013e576567a57c93867db2e9a35f74
SHA1 3fdbcc5383bc29f61f41e44c93c9236e17f04a1b
SHA512 155297ab56a491908bfe0945c089f79361a29d3c4606df436fd1871fe37926aa531be1becf62cc59d44a3cdc62e74c758c194967ab2bc25e1ead401e2148d451
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2296 created 732	2296	WerFault.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	732	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 732	3336	rundll32.exe	69
PID 3336 wrote to memory of 732	3336	rundll32.exe	69
PID 3336 wrote to memory of 732	3336	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e592747f806e94d779ab7e1f888f99b068b609ee1a1c8da9664bce42a6df21a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e592747f806e94d779ab7e1f888f99b068b609ee1a1c8da9664bce42a6df21a1.dll,#1
  2⤵
  PID:732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 804
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2296

memory/732-115-0x0000000002F90000-0x0000000002F9A000-memory.dmp

Download

memory/732-116-0x00000000032D0000-0x00000000034E4000-memory.dmp

Download

memory/732-118-0x0000000006230000-0x0000000006231000-memory.dmp

Download

memory/732-117-0x00000000061A0000-0x00000000061C3000-memory.dmp

Download