5bbab96d60704854efd8246a7d9371688b9102261544827fc8884126d70bcb3b

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 01:32

Target

Config/x86/CBSHost.dll
Size

122KB
MD5

9966252f6b62752f38bde0ff2970300d
SHA1

4c02d8470093db823f371bfc023d44ab80ad4970
SHA256

059f28e9b517b9345a30e409f1e7eecaab2d643a180dfa8fb1d105cac137cbb2
SHA512

f1c198b1e9b52fe8b96fbed9312328e73f4f5d989f72686b61b13abed9676fdd352e07bf4a48ed767ab6a38830489133f7cc217791a425fbf79c6b4a2c9cd82c
SSDEEP

3072:mbBSJBuX3y7IyNulaMf9GOGFSKvGFdof8HGOoK3kj:mbMuX3blaMf+aJvoK3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	2640	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2640	rundll32.exe
Token: 35	2640	rundll32.exe
Token: SeLoadDriverPrivilege	2640	rundll32.exe
Token: SeBackupPrivilege	2640	rundll32.exe
Token: SeRestorePrivilege	2640	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 2640 wrote to memory of 1184	2640	rundll32.exe	29
PID 2640 wrote to memory of 1184	2640	rundll32.exe	29
PID 2640 wrote to memory of 1184	2640	rundll32.exe	29
PID 2640 wrote to memory of 1184	2640	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\x86\CBSHost.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\x86\CBSHost.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 252
    3⤵
    - Program crash
    PID:1184