5bbab96d60704854efd8246a7d9371688b9102261544827fc8884126d70bcb3b

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2023, 01:32

Target

Config/x86/CBSHost.dll
Size

122KB
MD5

9966252f6b62752f38bde0ff2970300d
SHA1

4c02d8470093db823f371bfc023d44ab80ad4970
SHA256

059f28e9b517b9345a30e409f1e7eecaab2d643a180dfa8fb1d105cac137cbb2
SHA512

f1c198b1e9b52fe8b96fbed9312328e73f4f5d989f72686b61b13abed9676fdd352e07bf4a48ed767ab6a38830489133f7cc217791a425fbf79c6b4a2c9cd82c
SSDEEP

3072:mbBSJBuX3y7IyNulaMf9GOGFSKvGFdof8HGOoK3kj:mbMuX3blaMf+aJvoK3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	4364	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4364	rundll32.exe
Token: 35	4364	rundll32.exe
Token: SeLoadDriverPrivilege	4364	rundll32.exe
Token: SeBackupPrivilege	4364	rundll32.exe
Token: SeRestorePrivilege	4364	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4364	4256	rundll32.exe	85
PID 4256 wrote to memory of 4364	4256	rundll32.exe	85
PID 4256 wrote to memory of 4364	4256	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\x86\CBSHost.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\x86\CBSHost.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 628
    3⤵
    - Program crash
    PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4364 -ip 4364
1⤵
PID:1880