e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea

Resubmissions

13-10-2022 14:58

24-01-2022 00:49

Target

e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll
Size

164KB
MD5

cfefcc2edc5c54c74b76e7d1d29e69b2
SHA1

7423c57db390def08154b77e2b5e043d92d320c7
SHA256

e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea
SHA512

62d16f32a1c7d1063aa092a418555bd979f43367310f4ea4cd2eadd4edf4bbde474401980281d3d1fe3788245a25bab8280ce1ac1ffd83eee0ed38f026ececfd

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1144 created 2232 1144 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1144 2232 WerFault.exe rundll32.exe

description	pid	process	target process
PID 1144 created 2232	1144	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
1144	2232	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1144 WerFault.exe
Token: SeBackupPrivilege 1144 WerFault.exe
Token: SeDebugPrivilege 1144 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2916 wrote to memory of 2232	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2232	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2232	2916	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll,#1
2⤵
PID:2232

memory/2232-118-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2232-119-0x0000000000AD0000-0x0000000000AF3000-memory.dmp

Filesize
140KB

Download
memory/2232-121-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/2232-120-0x0000000000AD0000-0x0000000000AF3000-memory.dmp

Filesize
140KB

Download
memory/2232-122-0x0000000004350000-0x0000000004356000-memory.dmp

Filesize
24KB

Download