6d2c2b0b41711596eee38abdcba4570a123b6e469ed0c93f0a6bec0783a373bd

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:49

Target

078868268fe9a2ea1b97015064ed6037.dll
Size

846KB
MD5

078868268fe9a2ea1b97015064ed6037
SHA1

3641c33427833744ce39c3f838257aa90c8cfe74
SHA256

6d2c2b0b41711596eee38abdcba4570a123b6e469ed0c93f0a6bec0783a373bd
SHA512

effaa97c3d99278d236240a1ebe895cec7637bc22f79c4b1ee2d0223cb78c150dece9142090565b211aab5cfc21e2c863ad20111ac001995d44bf33f4b0cea38
SSDEEP

24576:LDovNZW5Ap+YzASMFrnUGCCSg8vRoh5Vuzs57:LuwFlFFhDuS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1540	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1540	rundll32.exe
Token: SeSecurityPrivilege	1540	rundll32.exe
Token: SeTakeOwnershipPrivilege	1540	rundll32.exe
Token: SeLoadDriverPrivilege	1540	rundll32.exe
Token: SeSystemProfilePrivilege	1540	rundll32.exe
Token: SeSystemtimePrivilege	1540	rundll32.exe
Token: SeProfSingleProcessPrivilege	1540	rundll32.exe
Token: SeIncBasePriorityPrivilege	1540	rundll32.exe
Token: SeCreatePagefilePrivilege	1540	rundll32.exe
Token: SeShutdownPrivilege	1540	rundll32.exe
Token: SeDebugPrivilege	1540	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1540	rundll32.exe
Token: SeRemoteShutdownPrivilege	1540	rundll32.exe
Token: SeUndockPrivilege	1540	rundll32.exe
Token: SeManageVolumePrivilege	1540	rundll32.exe
Token: 33	1540	rundll32.exe
Token: 34	1540	rundll32.exe
Token: 35	1540	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1540	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1540	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1540	1732	rundll32.exe	28
PID 1732 wrote to memory of 1540	1732	rundll32.exe	28
PID 1732 wrote to memory of 1540	1732	rundll32.exe	28
PID 1732 wrote to memory of 1540	1732	rundll32.exe	28
PID 1732 wrote to memory of 1540	1732	rundll32.exe	28
PID 1732 wrote to memory of 1540	1732	rundll32.exe	28
PID 1732 wrote to memory of 1540	1732	rundll32.exe	28
PID 1540 wrote to memory of 2004	1540	rundll32.exe	29
PID 1540 wrote to memory of 2004	1540	rundll32.exe	29
PID 1540 wrote to memory of 2004	1540	rundll32.exe	29
PID 1540 wrote to memory of 2004	1540	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\078868268fe9a2ea1b97015064ed6037.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\078868268fe9a2ea1b97015064ed6037.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 248
    3⤵
    - Program crash
    PID:2004

memory/1540-0-0x0000000001CF0000-0x0000000001DCB000-memory.dmp

Filesize
876KB

Download
memory/1540-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1540-2-0x0000000001CF0000-0x0000000001DCB000-memory.dmp

Filesize
876KB

Download
memory/1540-4-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download