13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6

Analysis

Target

13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6.dll
Size

164KB
MD5

db998ff70608040dcd06e0fc3fba1704
SHA1

1bca38d4c1f0a2f00a164687685186e02da61468
SHA256

13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6
SHA512

1d7c0697cc1fd6283a4e554ec4293d34d9b0cfee7946559022b30dd37c5cdd81a02593e6b601513002731b1aed71ee55c74ffa6594833eaf0c8234df8402b5b8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	1724	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
964	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1724	1400	rundll32.exe	27
PID 1400 wrote to memory of 1724	1400	rundll32.exe	27
PID 1400 wrote to memory of 1724	1400	rundll32.exe	27
PID 1400 wrote to memory of 1724	1400	rundll32.exe	27
PID 1400 wrote to memory of 1724	1400	rundll32.exe	27
PID 1400 wrote to memory of 1724	1400	rundll32.exe	27
PID 1400 wrote to memory of 1724	1400	rundll32.exe	27
PID 1724 wrote to memory of 964	1724	rundll32.exe	28
PID 1724 wrote to memory of 964	1724	rundll32.exe	28
PID 1724 wrote to memory of 964	1724	rundll32.exe	28
PID 1724 wrote to memory of 964	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13d4e3de896371db26a29b73f7d5e24f4f2a916da8deb0f249b8f604656bedd6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 196
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:964

memory/964-56-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1724-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download