af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd

Analysis

max time kernel
160s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:59

Target

af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll
Size

311KB
MD5

0dbf2e5fbcbc2a0f8128dac471ae1781
SHA1

18cc048f3dc7053f242b8c9cc4996ea7ca9b8ec1
SHA256

af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd
SHA512

7c26fe65cf712d72460d2c01c7e9bacfc23608646a516c9b0f7cff31e5f4bdc540ec5a44815e69c742f3f08fc179e68c2ef14138211a0f703f812e608b93b205
SSDEEP

6144:iqNG9C3ucRmzvXuQovJS0WEuE8c7eKfryJDvaLqi7LGjeOTB1VwAfAK:pNJucRmD5IJru67MaLqi76jeOT3h4K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	1152	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1152	4412	rundll32.exe	81
PID 4412 wrote to memory of 1152	4412	rundll32.exe	81
PID 4412 wrote to memory of 1152	4412	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 684
    3⤵
    - Program crash
    PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1152 -ip 1152
1⤵
PID:1804