09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74

Analysis

max time kernel
183s
max time network
145s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 19:34

Target

09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74.dll
Size

1.5MB
MD5

f8585ebb4c3fc7f8ce1e5336885dbfa5
SHA1

ce82dba65d739116ca63a77cbc1b9ceb0e17e82c
SHA256

09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74
SHA512

77a7df5909bc76ca6d1ce3425dc2534f92595c1abee60a36313404d427e21aed83848e91eac00b143dd55a8f57b0564ba3ebb1ccfe32d6670ba8798d0505441a
SSDEEP

24576:OL4zErtKjrRq+uVxg8lBV7vrmxS58ngncYfxbixqIRrYE4A84LE4dCi+a:3zErtnVHV21gncYZbixnRn4A8AnCi

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2788	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2788	WerFault.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2788	2732	rundll32.exe	29
PID 2732 wrote to memory of 2788	2732	rundll32.exe	29
PID 2732 wrote to memory of 2788	2732	rundll32.exe	29
PID 2732 wrote to memory of 2788	2732	rundll32.exe	29
PID 2732 wrote to memory of 2788	2732	rundll32.exe	29
PID 2732 wrote to memory of 2788	2732	rundll32.exe	29
PID 2732 wrote to memory of 2788	2732	rundll32.exe	29
PID 2788 wrote to memory of 2748	2788	rundll32.exe	30
PID 2788 wrote to memory of 2748	2788	rundll32.exe	30
PID 2788 wrote to memory of 2748	2788	rundll32.exe	30
PID 2788 wrote to memory of 2748	2788	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 328
    3⤵
    - Program crash
    PID:2748

memory/2788-0-0x0000000074B80000-0x0000000075028000-memory.dmp

Filesize
4.7MB

Download
memory/2788-1-0x0000000074B80000-0x0000000075028000-memory.dmp

Filesize
4.7MB

Download
memory/2788-2-0x00000000746D0000-0x0000000074B78000-memory.dmp

Filesize
4.7MB

Download
memory/2788-3-0x00000000746D0000-0x0000000074B78000-memory.dmp

Filesize
4.7MB

Download
memory/2788-4-0x00000000746D0000-0x0000000074B78000-memory.dmp

Filesize
4.7MB

Download
memory/2788-5-0x00000000746D0000-0x0000000074B78000-memory.dmp

Filesize
4.7MB

Download
memory/2788-6-0x0000000000160000-0x0000000000173000-memory.dmp

Filesize
76KB

Download
memory/2788-7-0x00000000746D0000-0x0000000074B78000-memory.dmp

Filesize
4.7MB

Download