da96c47a6a87fa4591bf6051b725fed00fa2341f557ee87dca3e60771604813b

Analysis

Target
da96c47a6a87fa4591bf6051b725fed00fa2341f557ee87dca3e60771604813b.dll
Size 164KB
Sample220124-a9m1eshadq
SHA256 da96c47a6a87fa4591bf6051b725fed00fa2341f557ee87dca3e60771604813b
MD5 ed83157feac92ecba56a3300fd5c95c2
SHA1 a1e19156280a7d7b13659dff0fdcae643066c80c
SHA512 50f97122a57824f9aaefa0debef0f56df5f737a74a991bc601c4356b75a98c0ee6a92f7fa0c279a573fe3ca73fc2ebd75e6d2d802fcf354d5f928450a40cc080
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3316 created 1484	3316	WerFault.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3316	1484	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1484	1464	rundll32.exe	68
PID 1464 wrote to memory of 1484	1464	rundll32.exe	68
PID 1464 wrote to memory of 1484	1464	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da96c47a6a87fa4591bf6051b725fed00fa2341f557ee87dca3e60771604813b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da96c47a6a87fa4591bf6051b725fed00fa2341f557ee87dca3e60771604813b.dll,#1
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 800
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3316

memory/1484-146-0x00000000027A0000-0x00000000027AA000-memory.dmp

Download

memory/1484-148-0x00000000027B0000-0x00000000027B1000-memory.dmp

Download