1c32da0dee5624d5cbc755a0cdb1257bf43f07c61fb03e8f59ef94ed2cb58869

Analysis

Target

1c32da0dee5624d5cbc755a0cdb1257bf43f07c61fb03e8f59ef94ed2cb58869.dll
Size

164KB
MD5

12ddb6465a43fbeecea2d2989f2caae8
SHA1

75ffba09e29e8f7481eb0844b601d7c9297aa855
SHA256

1c32da0dee5624d5cbc755a0cdb1257bf43f07c61fb03e8f59ef94ed2cb58869
SHA512

dbad58b9f12dcf81f7aad638005ded45768e943ef54165e81b9f2a70653e0d91d376c8374850c5c73ba0362950b4dba6b204bc36c9cfdca4d262584bda4c8019

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4060 created 3528 4060 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4060 3528 WerFault.exe rundll32.exe

description	pid	process	target process
PID 4060 created 3528	4060	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
4060	3528	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4060 WerFault.exe
Token: SeBackupPrivilege 4060 WerFault.exe
Token: SeDebugPrivilege 4060 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3416 wrote to memory of 3528	3416	rundll32.exe	rundll32.exe
PID 3416 wrote to memory of 3528	3416	rundll32.exe	rundll32.exe
PID 3416 wrote to memory of 3528	3416	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c32da0dee5624d5cbc755a0cdb1257bf43f07c61fb03e8f59ef94ed2cb58869.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c32da0dee5624d5cbc755a0cdb1257bf43f07c61fb03e8f59ef94ed2cb58869.dll,#1
2⤵
PID:3528

memory/3528-115-0x0000000002FB0000-0x0000000002FBA000-memory.dmp

Filesize
40KB

Download
memory/3528-116-0x0000000005C80000-0x0000000005CA3000-memory.dmp

Filesize
140KB

Download
memory/3528-118-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download
memory/3528-117-0x0000000005C80000-0x0000000005CA3000-memory.dmp

Filesize
140KB

Download
memory/3528-119-0x0000000005E00000-0x0000000005E06000-memory.dmp

Filesize
24KB

Download