99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c

Analysis

Target

99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c.dll
Size

185KB
MD5

cc5c5b2f2fd8af07824ae3b42f3b1a37
SHA1

31e4bf4a4ac684386709cd27e00491784e5564c4
SHA256

99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c
SHA512

a1b840bd1a4bc27a59e43619775374641887eae5486df6d76c2b3a541cb1dd6e9cd23d1e5d500e2d66d5e6da8aabe53be7f3ea5db8b22f7cf5c0afddcc05d399

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1592 1380 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1592 WerFault.exe
1592 WerFault.exe
1592 WerFault.exe
1592 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1592 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1592 WerFault.exe

pid	pid_target	process	target process
1592	1380	WerFault.exe	rundll32.exe

pid	process
1592	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1592	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1620 wrote to memory of 1380	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1380	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1380	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1380	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1380	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1380	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1380	1620	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 1592	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 1592	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 1592	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 1592	1380	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1380

memory/1380-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1592-57-0x0000000000240000-0x00000000002A0000-memory.dmp

Filesize
384KB

Download