fdd4258220a1c4da5ef7775a6a3c19b37808d2458f4019583076a158e4d1dca4

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 15:34

Target

fdd4258220a1c4da5ef7775a6a3c19b37808d2458f4019583076a158e4d1dca4.dll
Size

397KB
MD5

f94526d0a0b9fc5bb0a75b85eefcc9e8
SHA1

eae332d62e14a41ef8ef889cccc1c64a39376842
SHA256

fdd4258220a1c4da5ef7775a6a3c19b37808d2458f4019583076a158e4d1dca4
SHA512

9c3aa8a95d0051aa89edf5213b7675072c98d6f60bcbc1a85bc28f7e557b280a31e1680403d0b27e26d491acd9e212c1296d01f4cdc51af1a16c0030efee7d84
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaJ:174g2LDeiPDImOkx2LIaJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4776	4964	WerFault.exe	17

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	rundll32.exe
Token: SeTcbPrivilege	4964	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4964	2532	rundll32.exe	17
PID 2532 wrote to memory of 4964	2532	rundll32.exe	17
PID 2532 wrote to memory of 4964	2532	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdd4258220a1c4da5ef7775a6a3c19b37808d2458f4019583076a158e4d1dca4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdd4258220a1c4da5ef7775a6a3c19b37808d2458f4019583076a158e4d1dca4.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 720
    3⤵
    - Program crash
    PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4964 -ip 4964
1⤵
PID:2568