8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021

Analysis

Target

8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021.dll
Size

164KB
MD5

b914a72f794b8d7fb07219bbad04466f
SHA1

379d200d7d4d412762b84478f9a7017691363234
SHA256

8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021
SHA512

52f4cb79dce89d4a7bb5c2aeeeb9db7085a59fc73c36f92620595e17bf1b67208914a0c823d31d3f7ad428517da7d4a12b2dbd27a533d6c2067fa7dc665e03f7

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 952 created 2704 952 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

952 2704 WerFault.exe rundll32.exe

description	pid	process	target process
PID 952 created 2704	952	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
952	2704	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 952 WerFault.exe
Token: SeBackupPrivilege 952 WerFault.exe
Token: SeDebugPrivilege 952 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2180 wrote to memory of 2704	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2704	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2704	2180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021.dll,#1
2⤵
PID:2704

memory/2704-118-0x0000000002860000-0x0000000002B54000-memory.dmp

Filesize
3.0MB

Download
memory/2704-119-0x0000000002860000-0x0000000002B54000-memory.dmp

Filesize
3.0MB

Download
memory/2704-120-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/2704-121-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/2704-122-0x00000000057E0000-0x00000000057E6000-memory.dmp

Filesize
24KB

Download