e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea

Resubmissions

13/10/2022, 14:58

24/01/2022, 00:49

Target
e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll
Size 164KB
Sample220124-a6gdgaghgn
SHA256 e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea
MD5 cfefcc2edc5c54c74b76e7d1d29e69b2
SHA1 7423c57db390def08154b77e2b5e043d92d320c7
SHA512 62d16f32a1c7d1063aa092a418555bd979f43367310f4ea4cd2eadd4edf4bbde474401980281d3d1fe3788245a25bab8280ce1ac1ffd83eee0ed38f026ececfd
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1144 created 2232	1144	WerFault.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	2232	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2232	2916	rundll32.exe	69
PID 2916 wrote to memory of 2232	2916	rundll32.exe	69
PID 2916 wrote to memory of 2232	2916	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll,#1
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 724
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1144

memory/2232-118-0x00000000005F0000-0x00000000005FA000-memory.dmp

Download

memory/2232-119-0x0000000000AD0000-0x0000000000AF3000-memory.dmp

Download

memory/2232-121-0x0000000004340000-0x0000000004341000-memory.dmp

Download

memory/2232-120-0x0000000000AD0000-0x0000000000AF3000-memory.dmp

Download

memory/2232-122-0x0000000004350000-0x0000000004356000-memory.dmp

Download