ac2808932e8ba6331bc8d70db8c60c53e3042d8e936c7a787e7b9af88a0ac722

Analysis

Target

ac2808932e8ba6331bc8d70db8c60c53e3042d8e936c7a787e7b9af88a0ac722.dll
Size

164KB
MD5

e05f7ab2ef7d06af65a11313816a2692
SHA1

31db4e7171cc64383e0726bb5158a7fb736350a4
SHA256

ac2808932e8ba6331bc8d70db8c60c53e3042d8e936c7a787e7b9af88a0ac722
SHA512

6a031b31a975ca8b5d114a39a7eba459f9a573fa44522dc26b478db6fd40a30540f08597b60a93d3ec9e45c55a358948f9a0129fc89fb983b440d9c21a7df3eb

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3112 created 3548 3112 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3112 3548 WerFault.exe rundll32.exe

description	pid	process	target process
PID 3112 created 3548	3112	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
3112	3548	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3112 WerFault.exe
Token: SeBackupPrivilege 3112 WerFault.exe
Token: SeDebugPrivilege 3112 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3488 wrote to memory of 3548	3488	rundll32.exe	rundll32.exe
PID 3488 wrote to memory of 3548	3488	rundll32.exe	rundll32.exe
PID 3488 wrote to memory of 3548	3488	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac2808932e8ba6331bc8d70db8c60c53e3042d8e936c7a787e7b9af88a0ac722.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac2808932e8ba6331bc8d70db8c60c53e3042d8e936c7a787e7b9af88a0ac722.dll,#1
2⤵
PID:3548

memory/3548-115-0x0000000005AB0000-0x0000000005AD3000-memory.dmp

Filesize
140KB

Download
memory/3548-116-0x0000000005AB0000-0x0000000005AD3000-memory.dmp

Filesize
140KB

Download
memory/3548-117-0x0000000005AB0000-0x0000000005AD3000-memory.dmp

Filesize
140KB

Download
memory/3548-118-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/3548-119-0x0000000005C80000-0x0000000005C86000-memory.dmp

Filesize
24KB

Download