2c21ca7f232beffd48a26b0efb80cbbe93345184f29eee2cf175c73d6822c204

Analysis

max time kernel
141s
max time network
269s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 19:52

Target

KRNLWRD/injector.dll
Size

1.2MB
MD5

a1b9c6fdb702f4456a385ee93a1a77eb
SHA1

283b10148e08fa8bd6d8ec47f8e62c556fb768cc
SHA256

4cd782cfc5344a942f3f0a61c021122ded48b5e175de76f393419901708c04d4
SHA512

447ed5b2656fdb225c799270421b9e3459ac44ae7be06a84bd6c67c2304b8076eb562e3d191e8a43190338fa4e67a8b3cf7afd3eb788c707497cb090b98af0ca
SSDEEP

24576:F4L8ZNLC0RaGGeeh9dWHjQyAToCF+i15b1lpJyIOYCdcb65Jhz+:Fxf89ajQyAToCF+iVJyIHocb65Hz+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3464	2244	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	rundll32.exe
Token: SeLoadDriverPrivilege	2244	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2244	4836	rundll32.exe	83
PID 4836 wrote to memory of 2244	4836	rundll32.exe	83
PID 4836 wrote to memory of 2244	4836	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KRNLWRD\injector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KRNLWRD\injector.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 716
    3⤵
    - Program crash
    PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2244 -ip 2244
1⤵
PID:2484