c1ec9e1e5700abc200babd2a0ccd504ccf4feafc4c6c9f523b9fab27229a2474

Analysis

max time kernel
97s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 15:00

Target
c1ec9e1e5700abc200babd2a0ccd504ccf4feafc4c6c9f523b9fab27229a2474.dll
Size 212KB
Sample221206-sdrb3sgh37
SHA256 c1ec9e1e5700abc200babd2a0ccd504ccf4feafc4c6c9f523b9fab27229a2474
MD5 3c6460204f2801f808d4eed8d3d1b338
SHA1 0950e033fe3fa26718eb121d8ed2245803391e53
SHA512 9ad824516b4e6a36651e55c5ca98bddd74913af488761ab6d77bfcfca32be1cf8b2143b1923663459e448865483a642cd58b2fcafe4c74615b5ed90eb92a1bfb
SSDEEP 6144:x21GNmfXgeEnsv0jSEP5GSd2JgZAHUAEPf:mGNmfQeE/SeGSdygmlEPf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	1716	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1716	1952	rundll32.exe	83
PID 1952 wrote to memory of 1716	1952	rundll32.exe	83
PID 1952 wrote to memory of 1716	1952	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1ec9e1e5700abc200babd2a0ccd504ccf4feafc4c6c9f523b9fab27229a2474.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1ec9e1e5700abc200babd2a0ccd504ccf4feafc4c6c9f523b9fab27229a2474.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 712
    3⤵
    - Program crash
    PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1716 -ip 1716
1⤵
PID:4768