bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae

Analysis

max time kernel
147s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:06

Target

bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae.dll
Size

397KB
MD5

38246c03a147f2211d821b1dcc0ead8c
SHA1

68355530e6c29ff541a5a25fdc898260499a769c
SHA256

bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae
SHA512

c1c08aa74c5697f6f8b5c5ea7eb12a693f5684c00f06d02f1e6b7d8a2cf51a1238bb81bfc107689b1b5d2ae1019c0481804b29f5eee2da868e155778a72aae42
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaW:174g2LDeiPDImOkx2LIaW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	3180	WerFault.exe	16

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	rundll32.exe
Token: SeTcbPrivilege	3180	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3180	3096	rundll32.exe	16
PID 3096 wrote to memory of 3180	3096	rundll32.exe	16
PID 3096 wrote to memory of 3180	3096	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 692
  2⤵
  - Program crash
  PID:2116

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3180 -ip 3180
1⤵
PID:2072