38d3f0dc4a3730cdf971ef4aba264f3951870c113123d54aeb19c7df6d4f9aae

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 12:50

Target

38d3f0dc4a3730cdf971ef4aba264f3951870c113123d54aeb19c7df6d4f9aae.dll
Size

397KB
MD5

12a287e9731be4bc7b67001e33654799
SHA1

3074d4786005aa02b919457338ac9921594ca3bb
SHA256

38d3f0dc4a3730cdf971ef4aba264f3951870c113123d54aeb19c7df6d4f9aae
SHA512

e13116e3e4206b8bd056b7cad63da5ec44721c97162795faac6a74bc3c721a547d1687204ec41d674e7afb364a6ac2b4e036356f757167c60d286f4b61099173
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOar:174g2LDeiPDImOkx2LIar

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	936	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	rundll32.exe
Token: SeTcbPrivilege	936	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 936	2372	rundll32.exe	28
PID 2372 wrote to memory of 936	2372	rundll32.exe	28
PID 2372 wrote to memory of 936	2372	rundll32.exe	28
PID 2372 wrote to memory of 936	2372	rundll32.exe	28
PID 2372 wrote to memory of 936	2372	rundll32.exe	28
PID 2372 wrote to memory of 936	2372	rundll32.exe	28
PID 2372 wrote to memory of 936	2372	rundll32.exe	28
PID 936 wrote to memory of 2896	936	rundll32.exe	29
PID 936 wrote to memory of 2896	936	rundll32.exe	29
PID 936 wrote to memory of 2896	936	rundll32.exe	29
PID 936 wrote to memory of 2896	936	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38d3f0dc4a3730cdf971ef4aba264f3951870c113123d54aeb19c7df6d4f9aae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38d3f0dc4a3730cdf971ef4aba264f3951870c113123d54aeb19c7df6d4f9aae.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 312
    3⤵
    - Program crash
    PID:2896