de2be8ebd629be6b1175d3624d1d8e839c228a35bf29e3eacad572d37b94f85c

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2022, 15:21

Target

KRNLWRD/injector.dll
Size

1.2MB
MD5

a1b9c6fdb702f4456a385ee93a1a77eb
SHA1

283b10148e08fa8bd6d8ec47f8e62c556fb768cc
SHA256

4cd782cfc5344a942f3f0a61c021122ded48b5e175de76f393419901708c04d4
SHA512

447ed5b2656fdb225c799270421b9e3459ac44ae7be06a84bd6c67c2304b8076eb562e3d191e8a43190338fa4e67a8b3cf7afd3eb788c707497cb090b98af0ca
SSDEEP

24576:F4L8ZNLC0RaGGeeh9dWHjQyAToCF+i15b1lpJyIOYCdcb65Jhz+:Fxf89ajQyAToCF+iVJyIHocb65Hz+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4092	3920	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	rundll32.exe
Token: SeLoadDriverPrivilege	3920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 3920	884	rundll32.exe	81
PID 884 wrote to memory of 3920	884	rundll32.exe	81
PID 884 wrote to memory of 3920	884	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KRNLWRD\injector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KRNLWRD\injector.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 628
    3⤵
    - Program crash
    PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3920 -ip 3920
1⤵
PID:1044