0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 12:21

Target

0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e.dll
Size

397KB
MD5

abf31f5142f006b319ddf2d72bdf250a
SHA1

30997fd99925c327041eb9c354bdc2b2d1f2e573
SHA256

0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e
SHA512

aa60533db52c3a23a9339bd8110618b9beecdbd367ae0dfad69c9b4f9a5fd8bcb46567d7f02d63d3d5310628494d096c0ddaffde3bc34fc231a7289f4bef7fb0
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa4:174g2LDeiPDImOkx2LIa4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	2496	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	rundll32.exe
Token: SeTcbPrivilege	2496	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2496	2504	rundll32.exe	28
PID 2504 wrote to memory of 2496	2504	rundll32.exe	28
PID 2504 wrote to memory of 2496	2504	rundll32.exe	28
PID 2504 wrote to memory of 2496	2504	rundll32.exe	28
PID 2504 wrote to memory of 2496	2504	rundll32.exe	28
PID 2504 wrote to memory of 2496	2504	rundll32.exe	28
PID 2504 wrote to memory of 2496	2504	rundll32.exe	28
PID 2496 wrote to memory of 2468	2496	rundll32.exe	29
PID 2496 wrote to memory of 2468	2496	rundll32.exe	29
PID 2496 wrote to memory of 2468	2496	rundll32.exe	29
PID 2496 wrote to memory of 2468	2496	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 312
    3⤵
    - Program crash
    PID:2468