41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087

Analysis

max time kernel
62s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2023 20:09

Target

41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087.dll
Size

992KB
MD5

d63bab5c3a6a24199af6dc023b17c62c
SHA1

e0972397f9ab64d58ab95203ecfeff15d5c2997c
SHA256

41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087
SHA512

87e45ba4ad7979279fbf05d83c325d9a49b8da2578c98deff3a23db32f3af483cfe016f730affa8c7ce4311c546d28f7753f4b56b7a0e023798570d41721589a
SSDEEP

24576:6N3Dm6URDyyu8iQx/KQZqmTeJyu1QFN7wUM0i:6MuBTeFwWwU+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1468 1040 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1040 rundll32.exe

pid	pid_target	process	target process
1468	1040	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 1040	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1040	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1040	1400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 568
3⤵
- Program crash
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1040 -ip 1040
1⤵
PID:1404