d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c

Analysis

Target

d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll
Size

164KB
MD5

2e0d0aaed04118efd3f35aee6246ac1f
SHA1

73d6f1534e3a88b3dd0becaf16a450309c57be75
SHA256

d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c
SHA512

d3c126c38e19cdde8a85e6b61cf432fdcc329a018dc37a8e5725747c871113d43fe2ce5f7cb4765a9321585643b52e9570cac5fb0d9d85b49d41f5f0d486c371

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 520 created 3760 520 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

520 3760 WerFault.exe rundll32.exe

description	pid	process	target process
PID 520 created 3760	520	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
520	3760	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 520 WerFault.exe
Token: SeBackupPrivilege 520 WerFault.exe
Token: SeDebugPrivilege 520 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2708 wrote to memory of 3760	2708	rundll32.exe	rundll32.exe
PID 2708 wrote to memory of 3760	2708	rundll32.exe	rundll32.exe
PID 2708 wrote to memory of 3760	2708	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll,#1
2⤵
PID:3760

memory/3760-118-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/3760-117-0x0000000002840000-0x000000000284A000-memory.dmp

Filesize
40KB

Download
memory/3760-120-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3760-119-0x0000000002870000-0x000000000291E000-memory.dmp

Filesize
696KB

Download
memory/3760-121-0x0000000002C70000-0x0000000002C76000-memory.dmp

Filesize
24KB

Download