6b2a955a645fc744fa709853f51cdd142b83e806a89c8d5a68f6d465f3632899

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 13:12

Target

6b2a955a645fc744fa709853f51cdd142b83e806a89c8d5a68f6d465f3632899.dll
Size

397KB
MD5

cda16d274e2c79aa9a96d7ee7b95acf6
SHA1

703cca857a130cac9ed7cfeef54e711f34d949b4
SHA256

6b2a955a645fc744fa709853f51cdd142b83e806a89c8d5a68f6d465f3632899
SHA512

c4d3860b5d1fced4f6483b11cc71ddd2a3145b75eb516e45fce92df97e53c90e02fe10f921e3771ac3bbf94cb8c4b32d9fc07c73262c25cf7a73fcb37f0355ee
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa9:174g2LDeiPDImOkx2LIa9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	3324	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3324	rundll32.exe
Token: SeTcbPrivilege	3324	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 3324	3328	rundll32.exe	85
PID 3328 wrote to memory of 3324	3328	rundll32.exe	85
PID 3328 wrote to memory of 3324	3328	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b2a955a645fc744fa709853f51cdd142b83e806a89c8d5a68f6d465f3632899.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b2a955a645fc744fa709853f51cdd142b83e806a89c8d5a68f6d465f3632899.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 752
    3⤵
    - Program crash
    PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3324 -ip 3324
1⤵
PID:2164