e4cd904ca0635bd6af18fb3be45420b8a9e41ddfea05d2dcb096aa53cce6713e

Analysis

Target

e4cd904ca0635bd6af18fb3be45420b8a9e41ddfea05d2dcb096aa53cce6713e.dll
Size

180KB
MD5

ce550390d5effaa23fc8506ecd38c497
SHA1

c28ca4d073f93316c9b9665d063d9e0d31f86896
SHA256

e4cd904ca0635bd6af18fb3be45420b8a9e41ddfea05d2dcb096aa53cce6713e
SHA512

cda3a6d3e0b651fae9332b5afa88ac2573c6fd640d619bc85db5b0b2a7f85425d22f1f971b1a3f19c356efcaa37a973becd43a8794d05e410bbbbffbcc062816

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

592 528 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

592 WerFault.exe
592 WerFault.exe
592 WerFault.exe
592 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

592 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 592 WerFault.exe

pid	pid_target	process	target process
592	528	WerFault.exe	rundll32.exe

pid	process
592	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	592	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1156 wrote to memory of 528	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 528	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 528	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 528	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 528	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 528	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 528	1156	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 592	528	rundll32.exe	WerFault.exe
PID 528 wrote to memory of 592	528	rundll32.exe	WerFault.exe
PID 528 wrote to memory of 592	528	rundll32.exe	WerFault.exe
PID 528 wrote to memory of 592	528	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4cd904ca0635bd6af18fb3be45420b8a9e41ddfea05d2dcb096aa53cce6713e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4cd904ca0635bd6af18fb3be45420b8a9e41ddfea05d2dcb096aa53cce6713e.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:528

memory/528-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/592-57-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download