82911b0b856c9e64fc560f96949a2464928d3a5dd25ec5c2f16c9f1562a7bf5c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 21:36

Target

82911b0b856c9e64fc560f96949a2464928d3a5dd25ec5c2f16c9f1562a7bf5c.dll
Size

3.6MB
MD5

caacd5511766d98dcde5725ebd415b70
SHA1

dc54e2b59ca24e7864f5b18fe273e83022e222be
SHA256

82911b0b856c9e64fc560f96949a2464928d3a5dd25ec5c2f16c9f1562a7bf5c
SHA512

17265bfebddb3a4402779fc394b1cb0d1aae347656d850892a95622822b115fedaec638f59c495d1cf36b363ac0aff07a38894f248cf4ef5d27577ffb6106f94
SSDEEP

49152:yPZi07VfBeS3nE1ODQdRjTXFe8Uqe7sGbL70zlzfYJ/z+Iu:2eS3n5DcjTXAngGbLhJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	2300	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2300	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2300	2152	rundll32.exe	27
PID 2152 wrote to memory of 2300	2152	rundll32.exe	27
PID 2152 wrote to memory of 2300	2152	rundll32.exe	27
PID 2152 wrote to memory of 2300	2152	rundll32.exe	27
PID 2152 wrote to memory of 2300	2152	rundll32.exe	27
PID 2152 wrote to memory of 2300	2152	rundll32.exe	27
PID 2152 wrote to memory of 2300	2152	rundll32.exe	27
PID 2300 wrote to memory of 2276	2300	rundll32.exe	28
PID 2300 wrote to memory of 2276	2300	rundll32.exe	28
PID 2300 wrote to memory of 2276	2300	rundll32.exe	28
PID 2300 wrote to memory of 2276	2300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82911b0b856c9e64fc560f96949a2464928d3a5dd25ec5c2f16c9f1562a7bf5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\82911b0b856c9e64fc560f96949a2464928d3a5dd25ec5c2f16c9f1562a7bf5c.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 344
    3⤵
    - Program crash
    PID:2276