fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 12:22

Target

fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199.dll
Size

397KB
MD5

6e7f893d49c3210005d6fde845a8fcee
SHA1

d21abf30b9571e4e13e4003b0d3b1ff6121db0c1
SHA256

fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199
SHA512

26348d68ef6d4e5f1aeec2fcc529c2d1552d4c895786a9a00c7c594ac6b89ed9b2d1e8f6cf1964d7f5ffedc96f86083f7dc02318eff54a293b124ce7beebf834
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaz:174g2LDeiPDImOkx2LIaz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4388	1116	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	rundll32.exe
Token: SeTcbPrivilege	1116	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1116	2952	rundll32.exe	14
PID 2952 wrote to memory of 1116	2952	rundll32.exe	14
PID 2952 wrote to memory of 1116	2952	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 732
  2⤵
  - Program crash
  PID:4388

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1116 -ip 1116
1⤵
PID:4856