66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734

Analysis

Target

66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734.dll
Size

44KB
MD5

f4a46279bad62b50509c8729ba55b1fa
SHA1

0be2b50b31c4a22df95942081b1c0e13e3c79850
SHA256

66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734
SHA512

4325d47236cf796e1a169a4971c40cf9367de59bc435592c8857df8359c510209fa2b850331682393bd3abd005b09610270c7e40c5a4b6d680554cb21b285b4f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1696 892 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1696 WerFault.exe
1696 WerFault.exe
1696 WerFault.exe
1696 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1696 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1696 WerFault.exe

pid	pid_target	process	target process
1696	892	WerFault.exe	rundll32.exe

pid	process
1696	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1696	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1576 wrote to memory of 892	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 892	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 892	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 892	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 892	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 892	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 892	1576	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 1696	892	rundll32.exe	WerFault.exe
PID 892 wrote to memory of 1696	892	rundll32.exe	WerFault.exe
PID 892 wrote to memory of 1696	892	rundll32.exe	WerFault.exe
PID 892 wrote to memory of 1696	892	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:892

memory/892-54-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download