09e2888d1c7992a5c0f338865e7c16b6634ce56e4983f13623a9a37c267bd155

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 21:28

Target

09e2888d1c7992a5c0f338865e7c16b6634ce56e4983f13623a9a37c267bd155.dll
Size

1.1MB
MD5

50755dd03a499ce7e6eb739328bb4965
SHA1

581339292f0496c9fd4483fce35fa2eb55f1e196
SHA256

09e2888d1c7992a5c0f338865e7c16b6634ce56e4983f13623a9a37c267bd155
SHA512

09a59e5799ec384aaf3cfed26cdb88e556367d0b2bc75d05c0ef66d41f5bf6a2da0a706297033256ab903382eb56c6a1f02a110d9dc2d4ba95cac6ab00257ffc
SSDEEP

24576:0FMND666qP9nYhpo6DpQ638OFksYzDLnkT53yG:0FyDFlWfoIonOVl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3744	3864	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3864	3176	rundll32.exe	82
PID 3176 wrote to memory of 3864	3176	rundll32.exe	82
PID 3176 wrote to memory of 3864	3176	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09e2888d1c7992a5c0f338865e7c16b6634ce56e4983f13623a9a37c267bd155.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09e2888d1c7992a5c0f338865e7c16b6634ce56e4983f13623a9a37c267bd155.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 652
    3⤵
    - Program crash
    PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3864 -ip 3864
1⤵
PID:2752