bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b

Analysis

max time kernel
91s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:48

Target

bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b.dll
Size

33KB
MD5

978b8a61e0a8626b7547d697164369e9
SHA1

dd61b2e3f87fe2e74c1b425ac27ef924b807cd4e
SHA256

bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b
SHA512

f858f591ef4cad2378917e32671053a3637a61be1e45cbf6d54752f0890bec2800ef024783e9276869b8c2e5762164644815d6de1354cdca4c0c7a747a029051
SSDEEP

768:ZDcMyZhi+IiyzAH5EA0AH0QYXCv8nIwX3iiDG:ZoMyC+Iiy8HB5LbvAyGG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
788	4912	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4912	rundll32.exe
Token: SeDebugPrivilege	4912	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4912	4648	rundll32.exe	79
PID 4648 wrote to memory of 4912	4648	rundll32.exe	79
PID 4648 wrote to memory of 4912	4648	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc68adede318281802986aa6f6a7cac55048dac8a4a378616d805752bc4b580b.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 672
    3⤵
    - Program crash
    PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4912 -ip 4912
1⤵
PID:5004

memory/4912-133-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/4912-134-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download