e77b1f4456e8e8709e8c0e0aff0003af3767ffe7846afa878664407831290743

Analysis

Target
e77b1f4456e8e8709e8c0e0aff0003af3767ffe7846afa878664407831290743.dll
Size 166KB
Sample220124-a5n2xshaa7
SHA256 e77b1f4456e8e8709e8c0e0aff0003af3767ffe7846afa878664407831290743
MD5 f2440c173c422378430d78028a504068
SHA1 f5fe9cd7f7572c44df92f75990ddfb7d28a52560
SHA512 b4697427d07de04479e5b689bc146fac49b0b869bd96f457016d76d563c052b3c716327f30201d0e4ef2f97b0d9e1a2e6af37449df8fd9618c3c7735f4538fd3
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4016 created 3156	4016	WerFault.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4016	3156	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 3156	660	rundll32.exe	69
PID 660 wrote to memory of 3156	660	rundll32.exe	69
PID 660 wrote to memory of 3156	660	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e77b1f4456e8e8709e8c0e0aff0003af3767ffe7846afa878664407831290743.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e77b1f4456e8e8709e8c0e0aff0003af3767ffe7846afa878664407831290743.dll,#1
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 800
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4016

memory/3156-118-0x0000000000690000-0x000000000073E000-memory.dmp

Download

memory/3156-119-0x00000000006B0000-0x00000000009F4000-memory.dmp

Download

memory/3156-120-0x00000000006B0000-0x00000000009F4000-memory.dmp

Download

memory/3156-121-0x0000000000E60000-0x0000000000E66000-memory.dmp

Download