8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 11:41

Target

8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926.dll
Size

397KB
MD5

fa39bd131a3adecb5e00ac396ad5688b
SHA1

be26df349649db53081fbf1cb4aa23467f280345
SHA256

8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926
SHA512

2e9eccc25458f1b940d0538da1ccf6d25d033c1143fb46f4f63a6837b6a7edfbc30914be1f2c6451c83954cb258aaf2f4b7a3a35d15987aa36eb6e2eb0e8c081
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa0:174g2LDeiPDImOkx2LIa0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	2864	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	rundll32.exe
Token: SeTcbPrivilege	2864	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2864	1180	rundll32.exe	28
PID 1180 wrote to memory of 2864	1180	rundll32.exe	28
PID 1180 wrote to memory of 2864	1180	rundll32.exe	28
PID 1180 wrote to memory of 2864	1180	rundll32.exe	28
PID 1180 wrote to memory of 2864	1180	rundll32.exe	28
PID 1180 wrote to memory of 2864	1180	rundll32.exe	28
PID 1180 wrote to memory of 2864	1180	rundll32.exe	28
PID 2864 wrote to memory of 1100	2864	rundll32.exe	29
PID 2864 wrote to memory of 1100	2864	rundll32.exe	29
PID 2864 wrote to memory of 1100	2864	rundll32.exe	29
PID 2864 wrote to memory of 1100	2864	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 324
    3⤵
    - Program crash
    PID:1100