fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47

Analysis

Target
fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47.dll
Size 307KB
Sample220125-mswbpaedh5
SHA256 fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47
MD5 7cb7359f34bf7908de55d96e1c54ca03
SHA1 c759852918e7138c41dea25f8b26028a78374825
SHA512 cb6e5b88d7ec05539e6c83ec4f60afd8c46248afbed2115eabc0269b489acf748fc87a4785af6bc29e659e013465112827469ad5ffcaf10e66ae735a45aae796
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1404	1172	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1404	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1172	1908	rundll32.exe	27
PID 1908 wrote to memory of 1172	1908	rundll32.exe	27
PID 1908 wrote to memory of 1172	1908	rundll32.exe	27
PID 1908 wrote to memory of 1172	1908	rundll32.exe	27
PID 1908 wrote to memory of 1172	1908	rundll32.exe	27
PID 1908 wrote to memory of 1172	1908	rundll32.exe	27
PID 1908 wrote to memory of 1172	1908	rundll32.exe	27
PID 1172 wrote to memory of 1404	1172	rundll32.exe	28
PID 1172 wrote to memory of 1404	1172	rundll32.exe	28
PID 1172 wrote to memory of 1404	1172	rundll32.exe	28
PID 1172 wrote to memory of 1404	1172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 232
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1404

memory/1172-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/1404-56-0x0000000000430000-0x0000000000431000-memory.dmp

Download