b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d

Analysis

max time kernel
293s
max time network
307s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 00:17

Target

b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d.dll
Size

159KB
MD5

85b57c32bf0cc276bfcd20081ee0a21c
SHA1

4d3eb58b49f140dcd3504c790f502e546568b17a
SHA256

b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d
SHA512

c8334b8f719ce5c06b32551ce4a200698c245b106be837f52949c69fee2900e1c4213319e69cc1580ecdb9e4c2bbc3f7b07dcf678b1289db6c6c1b6e16a7bf11
SSDEEP

3072:zvKBqW2Ds3vjDzvFZCN77vgttSg8CqFjKnUH:N7vgWg8C9nG

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1916	1688	rundll32.exe	81
PID 1688 wrote to memory of 1916	1688	rundll32.exe	81
PID 1688 wrote to memory of 1916	1688	rundll32.exe	81
PID 1916 wrote to memory of 4888	1916	rundll32.exe	82
PID 1916 wrote to memory of 4888	1916	rundll32.exe	82
PID 1916 wrote to memory of 4888	1916	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe" /ppiftsvc
    3⤵
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1916 -ip 1916
1⤵
PID:2536

memory/1916-134-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download