40139fcf18773f40f0c19a8b441c35f3713fdf97baa555ef034d0a464d362cfd

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 11:05

Target

40139fcf18773f40f0c19a8b441c35f3713fdf97baa555ef034d0a464d362cfd.dll
Size

397KB
MD5

c04616ae0e3e25a8ff67745c9fbbb80e
SHA1

1ab4329b1be48141c2461d615c8bff3aeb651ae0
SHA256

40139fcf18773f40f0c19a8b441c35f3713fdf97baa555ef034d0a464d362cfd
SHA512

d4b8479f382c1d03717d332492b57360d4a2ea819c43c8dced9957d3abadbf9cb4872bb209e921471e0ec3fb2c1ddae470a6edf6147c38651e5adae6770f71ed
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaH:174g2LDeiPDImOkx2LIaH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3904	4052	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	rundll32.exe
Token: SeTcbPrivilege	4052	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4052	3976	rundll32.exe	14
PID 3976 wrote to memory of 4052	3976	rundll32.exe	14
PID 3976 wrote to memory of 4052	3976	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40139fcf18773f40f0c19a8b441c35f3713fdf97baa555ef034d0a464d362cfd.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 708
  2⤵
  - Program crash
  PID:3904

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40139fcf18773f40f0c19a8b441c35f3713fdf97baa555ef034d0a464d362cfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4052 -ip 4052
1⤵
PID:3152