92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e

Analysis

max time kernel
134s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 10:20

Target

92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e.dll
Size

397KB
MD5

9f445d3dfde1f07f4c424a153ca748db
SHA1

25615e143f060c85735a16dcc3c732130b15714a
SHA256

92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e
SHA512

fafe1db22e89fc9fbaec80fdaeae53e7961e6532c35f2f9f54fa35540aea0f12d50d2031d63dfb661014f1d0c7a899311cd375a7a8207e53f903835f7072f453
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaH:174g2LDeiPDImOkx2LIaH

Score

8^/10

Blocklisted process makes network request 7 IoCs

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	114.114.114.114

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4632	1612	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	rundll32.exe
Token: SeTcbPrivilege	1612	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1612	5020	rundll32.exe	88
PID 5020 wrote to memory of 1612	5020	rundll32.exe	88
PID 5020 wrote to memory of 1612	5020	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 708
    3⤵
    - Program crash
    PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1612 -ip 1612
1⤵
PID:2884