156021c8cc72c13435ff01affcee1b5b648c5ea93007aa5663eec80a16dd8131

Analysis

Target

628-56-0x0000000000120000-0x000000000012A000-memory.dll
Size

40KB
MD5

57285626c40ca3ccf51cf28e15fcf914
SHA1

a9902ea223e5cdaf00f7d8472c77adfa4cbb0824
SHA256

156021c8cc72c13435ff01affcee1b5b648c5ea93007aa5663eec80a16dd8131
SHA512

bbe5169fafb4b6d999a911e765920412550c9aca5acb78cee7bb085fae4125f760f2b8fc4af1563e465bbc41f6c46bf02f70e95771f0db1624bcd0de9f582d56

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

836 1084 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

836 WerFault.exe
836 WerFault.exe
836 WerFault.exe
836 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

836 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 836 WerFault.exe

pid	pid_target	process	target process
836	1084	WerFault.exe	rundll32.exe

pid	process
836	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	836	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1084 wrote to memory of 836	1084	rundll32.exe	WerFault.exe
PID 1084 wrote to memory of 836	1084	rundll32.exe	WerFault.exe
PID 1084 wrote to memory of 836	1084	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\628-56-0x0000000000120000-0x000000000012A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1084 -s 56
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:836

memory/836-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/836-55-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download