23251d989078d7d69c6cfe6de3c9f2102d5810266fc483e11e0c71ab000000ec

Analysis

Target

23251d989078d7d69c6cfe6de3c9f2102d5810266fc483e11e0c71ab000000ec.dll
Size

222KB
MD5

4cc0ab0723d94bf572c33ac7af89edba
SHA1

657f84c00323f99128856df23ea593d13addfbd5
SHA256

23251d989078d7d69c6cfe6de3c9f2102d5810266fc483e11e0c71ab000000ec
SHA512

8fdb7055e2098fc7ae814921d7128c215bf803a0ec1beb51b4d8ce6982a14aacf405cd3d3ff206a9a9834686eea147ad5251f4adcee065cdb9b9808d76570be2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1276 540 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1276 WerFault.exe
1276 WerFault.exe
1276 WerFault.exe
1276 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1276 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1276 WerFault.exe

pid	pid_target	process	target process
1276	540	WerFault.exe	rundll32.exe

pid	process
1276	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1276	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 540 wrote to memory of 1276	540	rundll32.exe	WerFault.exe
PID 540 wrote to memory of 1276	540	rundll32.exe	WerFault.exe
PID 540 wrote to memory of 1276	540	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23251d989078d7d69c6cfe6de3c9f2102d5810266fc483e11e0c71ab000000ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540

memory/1276-54-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Filesize
8KB

Download
memory/1276-55-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download