c9f4e72bfeaf8893313679bec867f28cc66e6993956c7c1eacbd6000ff4d89fe

Analysis

Target

1172-56-0x00000000001A0000-0x00000000001AA000-memory.dll
Size

40KB
MD5

53457fa357f45ba219467afdf28c2afe
SHA1

4e3e707c802fc647530171949ec8c8794326fd6a
SHA256

c9f4e72bfeaf8893313679bec867f28cc66e6993956c7c1eacbd6000ff4d89fe
SHA512

e9b2ef36b20353bc2688b38142f3e0364c9f8403a7bf3eb65aa1f54a386de659dfefb4410f775f33e14685759224f8819e64dd2a82d3175173fd34636fb89405

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1404 840 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1404 WerFault.exe
1404 WerFault.exe
1404 WerFault.exe
1404 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1404 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1404 WerFault.exe

pid	pid_target	process	target process
1404	840	WerFault.exe	rundll32.exe

pid	process
1404	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1404	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 840 wrote to memory of 1404	840	rundll32.exe	WerFault.exe
PID 840 wrote to memory of 1404	840	rundll32.exe	WerFault.exe
PID 840 wrote to memory of 1404	840	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1172-56-0x00000000001A0000-0x00000000001AA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 840 -s 56
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1404

memory/1404-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download
memory/1404-55-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download