13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6

Analysis

Target

13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6.dll
Size

164KB
MD5

db998ff70608040dcd06e0fc3fba1704
SHA1

1bca38d4c1f0a2f00a164687685186e02da61468
SHA256

13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6
SHA512

1d7c0697cc1fd6283a4e554ec4293d34d9b0cfee7946559022b30dd37c5cdd81a02593e6b601513002731b1aed71ee55c74ffa6594833eaf0c8234df8402b5b8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

964 1724 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

964 WerFault.exe
964 WerFault.exe
964 WerFault.exe
964 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

964 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 964 WerFault.exe

pid	pid_target	process	target process
964	1724	WerFault.exe	rundll32.exe

pid	process
964	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	964	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 1724	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1724	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1724	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1724	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1724	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1724	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1724	1400	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 964	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 964	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 964	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 964	1724	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1724

memory/964-56-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1724-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download