75707966e676c86bd9726223302c411e0914f3a664825eb6370dc18832f7a0bd

Analysis

Target

75707966e676c86bd9726223302c411e0914f3a664825eb6370dc18832f7a0bd.dll
Size

164KB
MD5

e5d5626e313ee5196d598472a2820105
SHA1

340f267eedc7303c0d3c5f93ca2e66ebdc4d75e1
SHA256

75707966e676c86bd9726223302c411e0914f3a664825eb6370dc18832f7a0bd
SHA512

778458c21d3b67be01ff778ebd2ae64003f83cadb651b5565261f6a8173131316033e176425f358c48587364c47ff77976375229009541c2209307969522915b

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1552 created 2776 1552 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 2776 WerFault.exe rundll32.exe

description	pid	process	target process
PID 1552 created 2776	1552	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
1552	2776	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1552 WerFault.exe
Token: SeBackupPrivilege 1552 WerFault.exe
Token: SeDebugPrivilege 1552 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2692 wrote to memory of 2776	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 2776	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 2776	2692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75707966e676c86bd9726223302c411e0914f3a664825eb6370dc18832f7a0bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75707966e676c86bd9726223302c411e0914f3a664825eb6370dc18832f7a0bd.dll,#1
2⤵
PID:2776

memory/2776-118-0x0000000003300000-0x0000000003323000-memory.dmp

Filesize
140KB

Download
memory/2776-119-0x0000000003300000-0x0000000003323000-memory.dmp

Filesize
140KB

Download
memory/2776-120-0x0000000003300000-0x0000000003323000-memory.dmp

Filesize
140KB

Download
memory/2776-121-0x0000000006130000-0x0000000006131000-memory.dmp

Filesize
4KB

Download
memory/2776-122-0x0000000006140000-0x0000000006146000-memory.dmp

Filesize
24KB

Download