e43008193a21bd8e58a78ce1337e297e2eb3dfde4600115f89d7058cbb3e2a0d

Analysis

Target
e43008193a21bd8e58a78ce1337e297e2eb3dfde4600115f89d7058cbb3e2a0d.dll
Size 180KB
Sample220124-a6hljaghgp
SHA256 e43008193a21bd8e58a78ce1337e297e2eb3dfde4600115f89d7058cbb3e2a0d
MD5 43627b969d3d02d61b49df10cdf834c3
SHA1 1e58c411233853542c7181f65173b4aefb902c5d
SHA512 705698c20664e0bb5b8a7e0d80b0703c498148fb44b2959b07714c1daa34dac1ea935d28fa805924cdc4605c76a8085cc4cf772f768542e8a2970e6570c8f570
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4100	3644	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3644	3440	rundll32.exe	68
PID 3440 wrote to memory of 3644	3440	rundll32.exe	68
PID 3440 wrote to memory of 3644	3440	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e43008193a21bd8e58a78ce1337e297e2eb3dfde4600115f89d7058cbb3e2a0d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e43008193a21bd8e58a78ce1337e297e2eb3dfde4600115f89d7058cbb3e2a0d.dll,#1
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 620
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4100