e37c76ee8ac1ac55ecd345075e82a160723dd5b9cfd03b0bf9d4d54307181471

Analysis

max time kernel
129s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 23:14

Target

ff283bc8ce0e7ea10f73ff9247529951.dll
Size

24KB
MD5

ff283bc8ce0e7ea10f73ff9247529951
SHA1

f79e6f05a3e14d7d69a99de175c52ee1a1fe169f
SHA256

e37c76ee8ac1ac55ecd345075e82a160723dd5b9cfd03b0bf9d4d54307181471
SHA512

8750f375f2c613e4fa006ac002366486839dabc8da3dfbf1ef38c447ab5ab3e006a4af57a881aaa8f85f7be9c0bebcd6a19d7bf6585083cf4d71e416b98f01a3
SSDEEP

192:CSt/dzHWn3fnwdAGC4F5k7KSsJRl496WHh/iuMwjqHh84M7hdyNbedrizZ+MT8IH:lvHWn3/wdojqlzGWfHh8rddyJ6Gz8+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4888	2240	WerFault.exe	91

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	rundll32.exe
Token: SeTakeOwnershipPrivilege	2240	rundll32.exe
Token: SeImpersonatePrivilege	2240	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2240	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 2240	3392	rundll32.exe	91
PID 3392 wrote to memory of 2240	3392	rundll32.exe	91
PID 3392 wrote to memory of 2240	3392	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff283bc8ce0e7ea10f73ff9247529951.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff283bc8ce0e7ea10f73ff9247529951.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 1464
    3⤵
    - Program crash
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2240 -ip 2240
1⤵
PID:4788

memory/2240-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2240-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2240-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2240-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download