c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99

Analysis

Target

c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll
Size

48KB
MD5

9f4863dc7d3ced05539183ddcb0a2f88
SHA1

5bfa025daa3724b7aaae25ceefb8e3166703c042
SHA256

c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99
SHA512

cfa8dc9f7816841a87ae1ef31a8d440f5881a5c4c066fbc097f5d654c02584081453499026764fcd723db6f6cb3a64e67e50da8e9b41b8814ef336022bf8072c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

592 848 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

592 WerFault.exe
592 WerFault.exe
592 WerFault.exe
592 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

592 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 592 WerFault.exe

pid	pid_target	process	target process
592	848	WerFault.exe	rundll32.exe

pid	process
592	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	592	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 980 wrote to memory of 848	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 848	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 848	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 848	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 848	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 848	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 848	980	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 592	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 592	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 592	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 592	848	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:848

memory/592-56-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/848-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download