bb17f99021137c7c236abed12773c51d9f944e95b3db5bc9ae0c5ad91402dea9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 07:23

Target

0e7e2953bd8852eaa0e13b3efd84edba.dll
Size

212KB
MD5

0e7e2953bd8852eaa0e13b3efd84edba
SHA1

fbedaa5cd6a841b40939eecb2ae65a0cf60f372a
SHA256

bb17f99021137c7c236abed12773c51d9f944e95b3db5bc9ae0c5ad91402dea9
SHA512

adc42cf5cd95d664ebe1ce80314835f8029d1e9e817c59468a1e7ba00d08cf5f712078ff25b19180cad6f85345a4eeb64ebbf5dd0d2d8bda6904e38987aec683
SSDEEP

3072:pPYXkbQ7k5i5KI5TCirOGInbZAGcCs2txoelqNU8z/APgXIVZt0SLEPgQ6S:lYXP53CiiGWcP2zVqjz4PgXIVAkEPJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4260	2388	WerFault.exe	15

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2388	2132	rundll32.exe	15
PID 2132 wrote to memory of 2388	2132	rundll32.exe	15
PID 2132 wrote to memory of 2388	2132	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e7e2953bd8852eaa0e13b3efd84edba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e7e2953bd8852eaa0e13b3efd84edba.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 712
    3⤵
    - Program crash
    PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2388 -ip 2388
1⤵
PID:4480