f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b

Analysis

max time kernel
168s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 16:15

Target

f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll
Size

397KB
MD5

b700be3adbe30c3124c0657f85803924
SHA1

9342e8b905c694ff29a66ab1d848f5038c23094d
SHA256

f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b
SHA512

30a4ad7ebe084565b4f0b744659b06a7541618c23b2cbda7911f21367d0ab265d28230ad87060575a7a14b667fd44e37be5896665bd96545d88f0c181acf66f2
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOap:174g2LDeiPDImOkx2LIap

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3648	2240	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	rundll32.exe
Token: SeTcbPrivilege	2240	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2240	828	rundll32.exe	89
PID 828 wrote to memory of 2240	828	rundll32.exe	89
PID 828 wrote to memory of 2240	828	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 716
    3⤵
    - Program crash
    PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2240 -ip 2240
1⤵
PID:2576