bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b

Analysis

max time kernel
12s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:48

Target

bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b.dll
Size

33KB
MD5

978b8a61e0a8626b7547d697164369e9
SHA1

dd61b2e3f87fe2e74c1b425ac27ef924b807cd4e
SHA256

bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b
SHA512

f858f591ef4cad2378917e32671053a3637a61be1e45cbf6d54752f0890bec2800ef024783e9276869b8c2e5762164644815d6de1354cdca4c0c7a747a029051
SSDEEP

768:ZDcMyZhi+IiyzAH5EA0AH0QYXCv8nIwX3iiDG:ZoMyC+Iiy8HB5LbvAyGG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	956	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	956	rundll32.exe
Token: SeDebugPrivilege	956	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 956	2040	rundll32.exe	28
PID 2040 wrote to memory of 956	2040	rundll32.exe	28
PID 2040 wrote to memory of 956	2040	rundll32.exe	28
PID 2040 wrote to memory of 956	2040	rundll32.exe	28
PID 2040 wrote to memory of 956	2040	rundll32.exe	28
PID 2040 wrote to memory of 956	2040	rundll32.exe	28
PID 2040 wrote to memory of 956	2040	rundll32.exe	28
PID 956 wrote to memory of 1420	956	rundll32.exe	29
PID 956 wrote to memory of 1420	956	rundll32.exe	29
PID 956 wrote to memory of 1420	956	rundll32.exe	29
PID 956 wrote to memory of 1420	956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 320
    3⤵
    - Program crash
    PID:1420

memory/956-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/956-57-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download