c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99

Analysis

Target

c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll
Size

48KB
MD5

9f4863dc7d3ced05539183ddcb0a2f88
SHA1

5bfa025daa3724b7aaae25ceefb8e3166703c042
SHA256

c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99
SHA512

cfa8dc9f7816841a87ae1ef31a8d440f5881a5c4c066fbc097f5d654c02584081453499026764fcd723db6f6cb3a64e67e50da8e9b41b8814ef336022bf8072c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
592	848	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
592	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 848	980	rundll32.exe	27
PID 980 wrote to memory of 848	980	rundll32.exe	27
PID 980 wrote to memory of 848	980	rundll32.exe	27
PID 980 wrote to memory of 848	980	rundll32.exe	27
PID 980 wrote to memory of 848	980	rundll32.exe	27
PID 980 wrote to memory of 848	980	rundll32.exe	27
PID 980 wrote to memory of 848	980	rundll32.exe	27
PID 848 wrote to memory of 592	848	rundll32.exe	28
PID 848 wrote to memory of 592	848	rundll32.exe	28
PID 848 wrote to memory of 592	848	rundll32.exe	28
PID 848 wrote to memory of 592	848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 196
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:592

memory/592-56-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/848-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download