6e25c3466e07948547b326316ace7679c1b1a77cca44f8034e54c82576a7acbb

Analysis

max time kernel
96s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 20:49

Target

6e25c3466e07948547b326316ace7679c1b1a77cca44f8034e54c82576a7acbb.dll
Size

896KB
MD5

b068a82cca417765c8b77a8ad6802759
SHA1

798aabc0775a2ba201225ec59bf54e6eca027972
SHA256

6e25c3466e07948547b326316ace7679c1b1a77cca44f8034e54c82576a7acbb
SHA512

bf11ddc94f600437050bbbf8ebc2cc41e9b501014cf5bcfe225d738c7df68538e1326d8dce9b961a9ba854a31557e8719d29955ad24152fb0d4ca042f1c071e1
SSDEEP

24576:L3HRNKyqmHVqWQQqzkUh0zgw7ELtBATumpdbIH:bH3+AfpdK

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\WINDOWS\SysWOW64\SkinH_EL.dll rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2288 3584 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 3584 rundll32.exe

description	ioc	process
File created	C:\WINDOWS\SysWOW64\SkinH_EL.dll	rundll32.exe

pid	pid_target	process	target process
2288	3584	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3584	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 456 wrote to memory of 3584	456	rundll32.exe	rundll32.exe
PID 456 wrote to memory of 3584	456	rundll32.exe	rundll32.exe
PID 456 wrote to memory of 3584	456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e25c3466e07948547b326316ace7679c1b1a77cca44f8034e54c82576a7acbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 932
3⤵
- Program crash
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3584 -ip 3584
1⤵
PID:944

memory/3584-142-0x0000000001640000-0x0000000001641000-memory.dmp

Filesize
4KB

Download
memory/3584-144-0x0000000001630000-0x0000000001631000-memory.dmp

Filesize
4KB

Download
memory/3584-145-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/3584-147-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/3584-146-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download