95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28

Analysis

Target

95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28.dll
Size

164KB
MD5

117dc83b400a889887c4e959f76ba1f7
SHA1

230743fc8e88c547d27de91192e9892cd8708c9f
SHA256

95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28
SHA512

9f17f3b8f53a2e4a2267d15900117b7674450c389ff53e1fa18b73b723703f5d5f6e5b61201f5b1b594c101607f92c4a2c80557684e4f16112286ff617b96fa6

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1384 created 3328 1384 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1384 3328 WerFault.exe rundll32.exe

description	pid	process	target process
PID 1384 created 3328	1384	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
1384	3328	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1384 WerFault.exe
Token: SeBackupPrivilege 1384 WerFault.exe
Token: SeDebugPrivilege 1384 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3672 wrote to memory of 3328	3672	rundll32.exe	rundll32.exe
PID 3672 wrote to memory of 3328	3672	rundll32.exe	rundll32.exe
PID 3672 wrote to memory of 3328	3672	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28.dll,#1
2⤵
PID:3328

memory/3328-116-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/3328-115-0x0000000003170000-0x000000000317A000-memory.dmp

Filesize
40KB

Download
memory/3328-117-0x0000000004CE0000-0x0000000004D03000-memory.dmp

Filesize
140KB

Download
memory/3328-118-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/3328-119-0x0000000004D80000-0x0000000004D86000-memory.dmp

Filesize
24KB

Download