42be24b8a2d478736029843f29b7a9c5fafcc1a4066ed8e372b43092d2e961a6

Analysis

max time kernel
156s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 15:58

Target

04966df1eb5b47dd654d4878e06f4a3d.dll
Size

308KB
MD5

04966df1eb5b47dd654d4878e06f4a3d
SHA1

aca43dafe847addad0780a32d8b9fa6470da1c7b
SHA256

42be24b8a2d478736029843f29b7a9c5fafcc1a4066ed8e372b43092d2e961a6
SHA512

b2b0dd2b1c5f394ee8a2ab192a0cda215650c2affcd33b2e3cadcca3bb41c78c2793891baa49ca8fe5419f471ba3db8fe3dd36f4d4be133bac55b8b47207bf41
SSDEEP

6144:QgFuZrcRm1eJKzcA6lYLspgidjGnNB0fjjlnw+E/HT7jn+TB2ADOrv:VFuZrcRmqycNVpgKFFE/Hfjn+THi7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	4084	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 4084	1160	rundll32.exe	81
PID 1160 wrote to memory of 4084	1160	rundll32.exe	81
PID 1160 wrote to memory of 4084	1160	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04966df1eb5b47dd654d4878e06f4a3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04966df1eb5b47dd654d4878e06f4a3d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 680
    3⤵
    - Program crash
    PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4084 -ip 4084
1⤵
PID:1604