a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24

Analysis

max time kernel
142s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2023 23:11

Target

Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Size

123KB
MD5

cb10fb803dc1f81b4bd324a5859b3ed5
SHA1

9e778c1253ea59de4ea76f97d858b0a8d23a2fd2
SHA256

f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9
SHA512

05865e3554c1f8c90673baf0681de88058c7202439bbecacaaab4ce97bdc60bc77cb1e89d54b3c4ed049c0140c4bb2784433e5dc500debc47a7605b98312506f
SSDEEP

1536:r8BG7Nckd6tnE0VVQrZzsIQSaB9a0OyJzL0OzfiPO4pPbEFvwfPISaOW9bmCDmf:rzikjEVQlQtBfOUPaP1zkqASxW9yCK

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	2496	rundll32.exe
20	2496	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	2496	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2496	4952	rundll32.exe	85
PID 4952 wrote to memory of 2496	4952	rundll32.exe	85
PID 4952 wrote to memory of 2496	4952	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Original\payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Original\payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1044
    3⤵
    - Program crash
    PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2496 -ip 2496
1⤵
PID:2500