a733760b6ec283f103e8eeca99a1fc6ff7173f7f5c49912db3293060fb6f9bf1

Analysis

Target

a733760b6ec283f103e8eeca99a1fc6ff7173f7f5c49912db3293060fb6f9bf1.dll
Size

164KB
MD5

f8c6aa1221cff707326a236c866f35cd
SHA1

17f5791a8744921e9f4f18c6413fded352f126ef
SHA256

a733760b6ec283f103e8eeca99a1fc6ff7173f7f5c49912db3293060fb6f9bf1
SHA512

dcbc7f416250403b64d9bf16c80b46a3018dfddd74fc2d731eaa5ec1ad4f22644b66ff566443a42abf979c1ab0980fa48118396796ac0e5f1d11eb220694161e

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3132 created 2020 3132 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3132 2020 WerFault.exe rundll32.exe

description	pid	process	target process
PID 3132 created 2020	3132	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
3132	2020	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3132 WerFault.exe
Token: SeBackupPrivilege 3132 WerFault.exe
Token: SeDebugPrivilege 3132 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1176 wrote to memory of 2020	1176	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2020	1176	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2020	1176	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a733760b6ec283f103e8eeca99a1fc6ff7173f7f5c49912db3293060fb6f9bf1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a733760b6ec283f103e8eeca99a1fc6ff7173f7f5c49912db3293060fb6f9bf1.dll,#1
2⤵
PID:2020

memory/2020-116-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/2020-115-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/2020-117-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/2020-118-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/2020-119-0x0000000005870000-0x0000000005876000-memory.dmp

Filesize
24KB

Download