15d323764f3deb22ad43702c2d98a1ae2ac0c94144d9b58b5bd4b718c3e9766e

Analysis

Target

1068-56-0x00000000000B0000-0x00000000000BA000-memory.dll
Size

40KB
MD5

0d3d475bf64bef98334735d4f7fd90dc
SHA1

b567b78afe9744a4bd2de8407d9ddaceb4a14c4a
SHA256

15d323764f3deb22ad43702c2d98a1ae2ac0c94144d9b58b5bd4b718c3e9766e
SHA512

d17eeef0582824c90bd167f2628bc053bc88e103f67008fbfba53d42af29df83ad80be5ac5ec40540ae5ab5b22878d18f0b98f0988eca5415ff50687da061d30

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

968 1708 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

968 WerFault.exe
968 WerFault.exe
968 WerFault.exe
968 WerFault.exe
968 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

968 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 968 WerFault.exe

pid	pid_target	process	target process
968	1708	WerFault.exe	rundll32.exe

pid	process
968	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	968	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1708 wrote to memory of 968	1708	rundll32.exe	WerFault.exe
PID 1708 wrote to memory of 968	1708	rundll32.exe	WerFault.exe
PID 1708 wrote to memory of 968	1708	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1068-56-0x00000000000B0000-0x00000000000BA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1708 -s 56
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:968

memory/968-54-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download
memory/968-55-0x0000000002050000-0x00000000022B0000-memory.dmp

Filesize
2.4MB

Download