09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74

Analysis

max time kernel
119s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 19:34

Target

09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74.dll
Size

1.5MB
MD5

f8585ebb4c3fc7f8ce1e5336885dbfa5
SHA1

ce82dba65d739116ca63a77cbc1b9ceb0e17e82c
SHA256

09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74
SHA512

77a7df5909bc76ca6d1ce3425dc2534f92595c1abee60a36313404d427e21aed83848e91eac00b143dd55a8f57b0564ba3ebb1ccfe32d6670ba8798d0505441a
SSDEEP

24576:OL4zErtKjrRq+uVxg8lBV7vrmxS58ngncYfxbixqIRrYE4A84LE4dCi+a:3zErtnVHV21gncYZbixnRn4A8AnCi

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1656	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3404	1656	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1656	2592	rundll32.exe	85
PID 2592 wrote to memory of 1656	2592	rundll32.exe	85
PID 2592 wrote to memory of 1656	2592	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bf85532a03d3e43a4dbdc89916007277881fb1ff44373b37fcabf0cc03be74.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 676
    3⤵
    - Program crash
    PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1656 -ip 1656
1⤵
PID:3824

memory/1656-0-0x0000000074D20000-0x00000000751C8000-memory.dmp

Filesize
4.7MB

Download
memory/1656-1-0x0000000074D20000-0x00000000751C8000-memory.dmp

Filesize
4.7MB

Download
memory/1656-2-0x0000000074D20000-0x00000000751C8000-memory.dmp

Filesize
4.7MB

Download
memory/1656-3-0x0000000074D20000-0x00000000751C8000-memory.dmp

Filesize
4.7MB

Download
memory/1656-4-0x0000000074D20000-0x00000000751C8000-memory.dmp

Filesize
4.7MB

Download