e5ef8837848d49d7dc7afd7480fc7432c1ee2cec6ebdc12d83c34fa88e5f37e9

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:25

Target

06dbe330db261199745d8778058058dd.dll
Size

980KB
MD5

06dbe330db261199745d8778058058dd
SHA1

a355efb97f58b860c9fbc2c4039fceb9724c0248
SHA256

e5ef8837848d49d7dc7afd7480fc7432c1ee2cec6ebdc12d83c34fa88e5f37e9
SHA512

d239c700c33d3fc32ccfda3c6b82f2c35119502431063d1a05a20a5442808ea6f70b4c2293fca0aa108e77cea336cb191e3eff065a572d29dcaa5cb46f15b1b2
SSDEEP

12288:MI7xl7vAW7JpuOf9hrDZ7LDvCWsnKNbQ95D4U4pIM/q:MI7xlcAvD/Z3vCWs+Q95DNyt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3200	2848	WerFault.exe	17

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2848	rundll32.exe
2848	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	rundll32.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2848	1728	rundll32.exe	17
PID 1728 wrote to memory of 2848	1728	rundll32.exe	17
PID 1728 wrote to memory of 2848	1728	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06dbe330db261199745d8778058058dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06dbe330db261199745d8778058058dd.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 784
    3⤵
    - Program crash
    PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2848 -ip 2848
1⤵
PID:4536