8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 15:21

Target

8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll
Size

397KB
MD5

efcec2128711aca7aa018b62ae5e765d
SHA1

36888f07b008868b31aafb6d1449ec64b2fbf26d
SHA256

8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79
SHA512

37e72d7bd6d8e917f959e5103d53d571d9dd56ae63149ffd0fc6b7e11896d09a8b67e5325dfab08add2acf527a9ec73291b6d8ac64144cf1b9345efc26454697
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaI:174g2LDeiPDImOkx2LIaI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1464	1904	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	rundll32.exe
Token: SeTcbPrivilege	1904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1904	5028	rundll32.exe	14
PID 5028 wrote to memory of 1904	5028	rundll32.exe	14
PID 5028 wrote to memory of 1904	5028	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 728
  2⤵
  - Program crash
  PID:1464

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1904 -ip 1904
1⤵
PID:2852