b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc

Analysis

Target

b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc.dll
Size

164KB
MD5

1929607abe0a6247be80b1ad7f272890
SHA1

39de4e83c82237c92d1cceaddf010362642141ed
SHA256

b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc
SHA512

c77660e1d51f644635197f6afa9e57fdfaedaf7d24550816ad105fdf737d87dfab9935ec092c2e3af115127e0c05a35900f8be83e051a9fe71d2fb4b0560e0e1

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2836 created 3488 2836 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2836 3488 WerFault.exe rundll32.exe

description	pid	process	target process
PID 2836 created 3488	2836	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
2836	3488	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2836 WerFault.exe
Token: SeBackupPrivilege 2836 WerFault.exe
Token: SeDebugPrivilege 2836 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2224 wrote to memory of 3488	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 3488	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 3488	2224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc.dll,#1
2⤵
PID:3488

memory/3488-119-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3488-118-0x0000000001240000-0x000000000124A000-memory.dmp

Filesize
40KB

Download
memory/3488-120-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/3488-121-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download
memory/3488-122-0x0000000003740000-0x0000000003746000-memory.dmp

Filesize
24KB

Download