dfad3171659c959cbff470e5c3f531a067936427e29c7f2b4c7b73961cefab35

Analysis

max time kernel
163s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 06:35

Target

dfad3171659c959cbff470e5c3f531a067936427e29c7f2b4c7b73961cefab35.dll
Size

872KB
MD5

6f4d1a91a7c28a62c5b2418e41ea4281
SHA1

03dc605be3edb6069a90190102389f7bb0be7163
SHA256

dfad3171659c959cbff470e5c3f531a067936427e29c7f2b4c7b73961cefab35
SHA512

5cfa1c46674124a3d5d6a0e7b1b44197d52bb2e687ac88064bce175b6e1ab32668292a355b2786e805a6b0f88475f43288aab81cf9dc82b514ea4b744c459212
SSDEEP

12288:4oSScBnDaAOeeO6kEAVokag6lIw48W0vOHzD:4oSR+zOnEuoLg6lB48W0vOHzD

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2228	1700	WerFault.exe	82
4536	1700	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	rundll32.exe

Suspicious use of SetWindowsHookEx 28 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1700	4500	rundll32.exe	82
PID 4500 wrote to memory of 1700	4500	rundll32.exe	82
PID 4500 wrote to memory of 1700	4500	rundll32.exe	82
PID 1700 wrote to memory of 2228	1700	rundll32.exe	86
PID 1700 wrote to memory of 2228	1700	rundll32.exe	86
PID 1700 wrote to memory of 2228	1700	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfad3171659c959cbff470e5c3f531a067936427e29c7f2b4c7b73961cefab35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfad3171659c959cbff470e5c3f531a067936427e29c7f2b4c7b73961cefab35.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 772
    3⤵
    - Program crash
    PID:2228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 772
    3⤵
    - Program crash
    PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1700 -ip 1700
1⤵
PID:2924