808a670ebd04669219b4a2733b08f0a2bd88492858e328a9acabf80f5f6706d6

Analysis

max time kernel
138s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 20:35

Target

808a670ebd04669219b4a2733b08f0a2bd88492858e328a9acabf80f5f6706d6.dll
Size

2.6MB
MD5

c951ecd6c2c71ceca04f3028dca72505
SHA1

5d48b5aa8374c8d3af24850e7377f65eb29b1716
SHA256

808a670ebd04669219b4a2733b08f0a2bd88492858e328a9acabf80f5f6706d6
SHA512

b96f777ae61d0ec1654a1fb6a01eb4b77352d460b1eb0f91780d28a2e07f919a81b74cbabf46d6d7f24d8c7cd153a990191be931f24215f517fea64df1e6651b
SSDEEP

49152:YSxOI7Yog1iCo7H9okD0IIUnbD1qCFDt4TAKxjIqnGc:HLYogUCY9oi9ntqCF5a5xEqnp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3728	3800	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3800	1216	rundll32.exe	81
PID 1216 wrote to memory of 3800	1216	rundll32.exe	81
PID 1216 wrote to memory of 3800	1216	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\808a670ebd04669219b4a2733b08f0a2bd88492858e328a9acabf80f5f6706d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\808a670ebd04669219b4a2733b08f0a2bd88492858e328a9acabf80f5f6706d6.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 732
    3⤵
    - Program crash
    PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3800 -ip 3800
1⤵
PID:4908