c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a

Analysis

Target
c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a.dll
Size 164KB
Sample220124-bgnxpahcc8
SHA256 c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a
MD5 34c7caf74e06c60991d41df99ff387f4
SHA1 6a1ce2234360cc4d55100905581ef5370589498c
SHA512 85fa9b7ccafb2731777eab4f323f29920208e21de4630031f5d4e8c9bc9287254d1cf4af4662344ff15277dd44fb8d131469909d6de4352fda72638c2f6b4350
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2252 created 920	2252	WerFault.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	920	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 920	800	rundll32.exe	68
PID 800 wrote to memory of 920	800	rundll32.exe	68
PID 800 wrote to memory of 920	800	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a.dll,#1
  2⤵
  PID:920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 792
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2252

memory/920-118-0x0000000003350000-0x000000000335A000-memory.dmp

Download

memory/920-119-0x0000000004DE0000-0x0000000004E03000-memory.dmp

Download

memory/920-120-0x0000000004DE0000-0x0000000004E03000-memory.dmp

Download

memory/920-121-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/920-122-0x0000000004FA0000-0x0000000004FA6000-memory.dmp

Download