fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47

Analysis

Target
fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47.dll
Size 307KB
Sample220125-mswbpaedh5
SHA256 fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47
MD5 7cb7359f34bf7908de55d96e1c54ca03
SHA1 c759852918e7138c41dea25f8b26028a78374825
SHA512 cb6e5b88d7ec05539e6c83ec4f60afd8c46248afbed2115eabc0269b489acf748fc87a4785af6bc29e659e013465112827469ad5ffcaf10e66ae735a45aae796
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	2700	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2700	2656	rundll32.exe	68
PID 2656 wrote to memory of 2700	2656	rundll32.exe	68
PID 2656 wrote to memory of 2700	2656	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe1559c3bd1c4e75dbcbfd4a6610bcb48ff93874e340be80a2eb75debd820a47.dll,#1
  2⤵
  PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 644
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2560