58e07a3d3b1335ef053294525434ec32119d06f1969d5ff3ba049c3f5e1aa412

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:05

Target

04010ac1a35c3c9a77c17d67c51db191.dll
Size

7KB
MD5

04010ac1a35c3c9a77c17d67c51db191
SHA1

c6f59f86ccefaa3c26c82292c9f38afdb47565b4
SHA256

58e07a3d3b1335ef053294525434ec32119d06f1969d5ff3ba049c3f5e1aa412
SHA512

3ac577e7c149a88d5618185a6d2573bcce8afc92771754275933c56a52c55b7b77decd4627f728001a930c327c6b42160464fa6e3b0a04580131609643cf140e
SSDEEP

96:wOfC21FMW3cLJMZiiSBDrMrg12yMrSNxLP8k2ofHZDL2DnC2cBS:b1FMW3c6gPBP7YVrSNxLP0nck

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4924	556	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 556	5088	rundll32.exe	25
PID 5088 wrote to memory of 556	5088	rundll32.exe	25
PID 5088 wrote to memory of 556	5088	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04010ac1a35c3c9a77c17d67c51db191.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04010ac1a35c3c9a77c17d67c51db191.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 860
    3⤵
    - Program crash
    PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 556 -ip 556
1⤵
PID:4324

memory/556-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download