a76c24417760d6caaeed0c4877c5b4bd9d102a799ac7ed2b54776d0dac4828a7

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:19

Target

a76c24417760d6caaeed0c4877c5b4bd9d102a799ac7ed2b54776d0dac4828a7.dll
Size

680KB
MD5

52b1afc34157497a7c5d9106166e9160
SHA1

effbfe7baad847b78caca1a4f80460c4e9a27beb
SHA256

a76c24417760d6caaeed0c4877c5b4bd9d102a799ac7ed2b54776d0dac4828a7
SHA512

2b81cb93b39f781e2d8e4a0de4e02133fb231a9f0f9d1fa27cbb5e9c4a6b58be4785c945099fba6075048a50511a7558788776a31cfb9b11c2fb759886700368
SSDEEP

12288:X2DFtdILWpX2ihzx7/21n8PwvgqUGKrW7lVEhBTiyLlW6ASMJg/6gP2rHcJMJ6iX:X2DXdISpmi37/2hdOA9xZX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1920 1932 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1920	1932	WerFault.exe	rundll32.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

rundll32.exe

description	pid	process
Token: 1	1932	rundll32.exe
Token: SeCreateTokenPrivilege	1932	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	1932	rundll32.exe
Token: SeLockMemoryPrivilege	1932	rundll32.exe
Token: SeIncreaseQuotaPrivilege	1932	rundll32.exe
Token: SeMachineAccountPrivilege	1932	rundll32.exe
Token: SeTcbPrivilege	1932	rundll32.exe
Token: SeSecurityPrivilege	1932	rundll32.exe
Token: SeTakeOwnershipPrivilege	1932	rundll32.exe
Token: SeLoadDriverPrivilege	1932	rundll32.exe
Token: SeSystemProfilePrivilege	1932	rundll32.exe
Token: SeSystemtimePrivilege	1932	rundll32.exe
Token: SeProfSingleProcessPrivilege	1932	rundll32.exe
Token: SeIncBasePriorityPrivilege	1932	rundll32.exe
Token: SeCreatePagefilePrivilege	1932	rundll32.exe
Token: SeCreatePermanentPrivilege	1932	rundll32.exe
Token: SeBackupPrivilege	1932	rundll32.exe
Token: SeRestorePrivilege	1932	rundll32.exe
Token: SeShutdownPrivilege	1932	rundll32.exe
Token: SeDebugPrivilege	1932	rundll32.exe
Token: SeAuditPrivilege	1932	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1932	rundll32.exe
Token: SeChangeNotifyPrivilege	1932	rundll32.exe
Token: SeRemoteShutdownPrivilege	1932	rundll32.exe
Token: SeUndockPrivilege	1932	rundll32.exe
Token: SeSyncAgentPrivilege	1932	rundll32.exe
Token: SeEnableDelegationPrivilege	1932	rundll32.exe
Token: SeManageVolumePrivilege	1932	rundll32.exe
Token: SeImpersonatePrivilege	1932	rundll32.exe
Token: SeCreateGlobalPrivilege	1932	rundll32.exe
Token: 31	1932	rundll32.exe
Token: 32	1932	rundll32.exe
Token: 33	1932	rundll32.exe
Token: 34	1932	rundll32.exe
Token: 35	1932	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1932 rundll32.exe

pid	process
1932	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1896 wrote to memory of 1932	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 1932	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 1932	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 1932	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 1932	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 1932	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 1932	1896	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 1920	1932	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a76c24417760d6caaeed0c4877c5b4bd9d102a799ac7ed2b54776d0dac4828a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 300
3⤵
- Program crash
PID:1920

memory/1920-56-0x0000000000000000-mapping.dmp

Download
memory/1932-54-0x0000000000000000-mapping.dmp

Download
memory/1932-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1932-57-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download