1dc94def4961bb0588f4215d20fed2c50e72311139642d977f0c099ed7155d18

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 01:52

Target

d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44.dll
Size

855KB
MD5

8d18fea5750aede09464bbbd7c0df6a6
SHA1

6b18625f114ac1201f16e3fd2e9131a0406062e9
SHA256

d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44
SHA512

237ac4d7331cabc8fd0b5309bf293e78ad0887783a173374406516e196a2cab7b656067ffccf19deca19aa2e46304738cb61195e0d6286e3bad7c1203fdf0620
SSDEEP

24576:57UuAhS4VYKBOSR45LlxAh/uSLKAlr/A/cYV5fN:A/YVSulxb1AlurF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4304	4736	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1636	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4736	2328	rundll32.exe	85
PID 2328 wrote to memory of 4736	2328	rundll32.exe	85
PID 2328 wrote to memory of 4736	2328	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44.dll,#1
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 600
    3⤵
    - Program crash
    PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4736 -ip 4736
1⤵
PID:4188

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636

memory/1636-0-0x0000021082940000-0x0000021082950000-memory.dmp

Filesize
64KB

Download
memory/1636-16-0x0000021082A40000-0x0000021082A50000-memory.dmp

Filesize
64KB

Download
memory/1636-32-0x000002108AD60000-0x000002108AD61000-memory.dmp

Filesize
4KB

Download
memory/1636-34-0x000002108AD90000-0x000002108AD91000-memory.dmp

Filesize
4KB

Download
memory/1636-35-0x000002108AD90000-0x000002108AD91000-memory.dmp

Filesize
4KB

Download
memory/1636-36-0x000002108AEA0000-0x000002108AEA1000-memory.dmp

Filesize
4KB

Download