149df23d9a0e658f401478ee95a284a35b58a1d30d9ea420e3147034f5fedbe5

Analysis

Target

locale_772.dll
Size

301KB
MD5

69e1fa92dc8430cb1cacb6c2060cff26
SHA1

22fa67584a986738ee77d204aa7290f2a6a6cdfb
SHA256

c5b9eab2b92b03206b6d46e9d5b478e5e0cbf9917a5c3b17eafbcf90f987f454
SHA512

8f3463e172b6b9c1da705a07326de906c29c0d549f12911fd63ba15b1f42c23fcd8cf0be0ec9834bf8331e5fcf721406c950b49b68fcae790b4f042e309b4031

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 1536 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1720 WerFault.exe
1720 WerFault.exe
1720 WerFault.exe
1720 WerFault.exe
1720 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1720 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1720 WerFault.exe

pid	pid_target	process	target process
1720	1536	WerFault.exe	rundll32.exe

pid	process
1720	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1720	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1536 wrote to memory of 1720	1536	rundll32.exe	WerFault.exe
PID 1536 wrote to memory of 1720	1536	rundll32.exe	WerFault.exe
PID 1536 wrote to memory of 1720	1536	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\locale_772.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536

memory/1720-55-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download
memory/1720-56-0x0000000001C50000-0x0000000001C51000-memory.dmp

Filesize
4KB

Download