befd8b5b90ef38e3d04711b0aae55805149ad1f3c77eb39bc9002760ce1684b6

Analysis

Target

befd8b5b90ef38e3d04711b0aae55805149ad1f3c77eb39bc9002760ce1684b6.dll
Size

135KB
MD5

74668e84ee38695216ef737f389dc55c
SHA1

e4d6928f6592a2a38d880cff7e0f30db2a15896e
SHA256

befd8b5b90ef38e3d04711b0aae55805149ad1f3c77eb39bc9002760ce1684b6
SHA512

90a550498a77284e5a936d92513994976ed5b67ffd8f5ca1476570f1c7307f69ed8400e86ab2588d24c77df66279daca98e4735b1b650cf46770093a7d1b8c24

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1268	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1612	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1268	1616	rundll32.exe	27
PID 1616 wrote to memory of 1268	1616	rundll32.exe	27
PID 1616 wrote to memory of 1268	1616	rundll32.exe	27
PID 1616 wrote to memory of 1268	1616	rundll32.exe	27
PID 1616 wrote to memory of 1268	1616	rundll32.exe	27
PID 1616 wrote to memory of 1268	1616	rundll32.exe	27
PID 1616 wrote to memory of 1268	1616	rundll32.exe	27
PID 1268 wrote to memory of 1612	1268	rundll32.exe	28
PID 1268 wrote to memory of 1612	1268	rundll32.exe	28
PID 1268 wrote to memory of 1612	1268	rundll32.exe	28
PID 1268 wrote to memory of 1612	1268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\befd8b5b90ef38e3d04711b0aae55805149ad1f3c77eb39bc9002760ce1684b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\befd8b5b90ef38e3d04711b0aae55805149ad1f3c77eb39bc9002760ce1684b6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 224
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1612

memory/1268-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1612-57-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download