66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734

Analysis

Target
66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734.dll
Size 44KB
Sample220201-pvbfeaecbm
SHA256 66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734
MD5 f4a46279bad62b50509c8729ba55b1fa
SHA1 0be2b50b31c4a22df95942081b1c0e13e3c79850
SHA512 4325d47236cf796e1a169a4971c40cf9367de59bc435592c8857df8359c510209fa2b850331682393bd3abd005b09610270c7e40c5a4b6d680554cb21b285b4f
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	892	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1696	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 892	1576	rundll32.exe	27
PID 1576 wrote to memory of 892	1576	rundll32.exe	27
PID 1576 wrote to memory of 892	1576	rundll32.exe	27
PID 1576 wrote to memory of 892	1576	rundll32.exe	27
PID 1576 wrote to memory of 892	1576	rundll32.exe	27
PID 1576 wrote to memory of 892	1576	rundll32.exe	27
PID 1576 wrote to memory of 892	1576	rundll32.exe	27
PID 892 wrote to memory of 1696	892	rundll32.exe	28
PID 892 wrote to memory of 1696	892	rundll32.exe	28
PID 892 wrote to memory of 1696	892	rundll32.exe	28
PID 892 wrote to memory of 1696	892	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66bfc2229570bd459028fbf92dd31cf2adb1895024e23ed6492ecdd33f1cd734.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 196
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1696

memory/892-54-0x0000000076451000-0x0000000076453000-memory.dmp

Download

memory/1696-56-0x0000000000420000-0x0000000000421000-memory.dmp

Download