da482b46353f652ea536d29cc0709537512dbee701e8d026497676e8cf4ad36b

Analysis

Target

da482b46353f652ea536d29cc0709537512dbee701e8d026497676e8cf4ad36b.dll
Size

52KB
MD5

9bb745f96f1afe73dc77f640d968c8a2
SHA1

f13287ed1cefa1da141005158d8db2f3b1505d08
SHA256

da482b46353f652ea536d29cc0709537512dbee701e8d026497676e8cf4ad36b
SHA512

b5cde3dbd779e9567e98dc63bbbd0ae23aa1d786cb7ce5af1639ef7400764afa26528e811e66310622bd564908edf6c65a385fe5697eee100f7c6a1612848581

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	1624	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1796	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1796	1624	rundll32.exe	27
PID 1624 wrote to memory of 1796	1624	rundll32.exe	27
PID 1624 wrote to memory of 1796	1624	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da482b46353f652ea536d29cc0709537512dbee701e8d026497676e8cf4ad36b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1624 -s 56
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1796

memory/1796-54-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Filesize
8KB

Download
memory/1796-55-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download