809496d8c7d873967459ae448fadb58d2edacf8a1afca3ee3587e10b68bdf2dc

Analysis

Target

809496d8c7d873967459ae448fadb58d2edacf8a1afca3ee3587e10b68bdf2dc.dll
Size

166KB
MD5

47145cf0712bfcaa8c256b1d1ae60565
SHA1

c6cfb4f4e7dffc3735ca401a2d39126c695599fd
SHA256

809496d8c7d873967459ae448fadb58d2edacf8a1afca3ee3587e10b68bdf2dc
SHA512

7920596c205496f9ce98fa607cd31049e1738ff7ae49a7728470527182268f180fe551f607a0ad51b8c569578eab82999338b14c134636ada84357dd8b20d4ac

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 508 created 3512 508 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

508 3512 WerFault.exe rundll32.exe

description	pid	process	target process
PID 508 created 3512	508	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
508	3512	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 508 WerFault.exe
Token: SeBackupPrivilege 508 WerFault.exe
Token: SeDebugPrivilege 508 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2256 wrote to memory of 3512	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 3512	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 3512	2256	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\809496d8c7d873967459ae448fadb58d2edacf8a1afca3ee3587e10b68bdf2dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\809496d8c7d873967459ae448fadb58d2edacf8a1afca3ee3587e10b68bdf2dc.dll,#1
2⤵
PID:3512

memory/3512-115-0x0000000001050000-0x0000000001073000-memory.dmp

Filesize
140KB

Download
memory/3512-117-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download
memory/3512-116-0x0000000001050000-0x0000000001073000-memory.dmp

Filesize
140KB

Download
memory/3512-118-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/3512-119-0x0000000004900000-0x0000000004906000-memory.dmp

Filesize
24KB

Download