4b20fef90dac727ff1edfffb988f901fcb3ed9b5894ad252cd4dc38a36b16409

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 12:10

Target

4b20fef90dac727ff1edfffb988f901fcb3ed9b5894ad252cd4dc38a36b16409.dll
Size

397KB
MD5

96d1b3dad6f77648cd77d470bc6df0e7
SHA1

b674b26f5ae632adaa5814fbb3abc14d857c57f0
SHA256

4b20fef90dac727ff1edfffb988f901fcb3ed9b5894ad252cd4dc38a36b16409
SHA512

974b792ebecdf7820c6ca46d5a256537600d86e7f371faa456a715af865ea20fa48a6fe8cf3fd4341f24a237417dce3207a35bda9342f5f514f73ce3a7018420
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOak:174g2LDeiPDImOkx2LIak

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
680	4716	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	rundll32.exe
Token: SeTcbPrivilege	4716	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4716	3760	rundll32.exe	88
PID 3760 wrote to memory of 4716	3760	rundll32.exe	88
PID 3760 wrote to memory of 4716	3760	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b20fef90dac727ff1edfffb988f901fcb3ed9b5894ad252cd4dc38a36b16409.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b20fef90dac727ff1edfffb988f901fcb3ed9b5894ad252cd4dc38a36b16409.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 700
    3⤵
    - Program crash
    PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4716 -ip 4716
1⤵
PID:3040