e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 19:52

Target

e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e.dll
Size

397KB
MD5

ff7a044a2e31360333eafe7832725714
SHA1

a626beaa75fdb8a7dc3e943238e133a6cd56411e
SHA256

e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e
SHA512

3a660f65eafeea9de8e0b215f739249aacb25cd65f4c000c050b4009ba3feeb4d040cf007834aee335c8df1151149bb2f32f0ba25eea92e920ad34184a7e2c0d
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOac:174g2LDeiPDImOkx2LIac

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	612	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	rundll32.exe
Token: SeTcbPrivilege	612	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 2076 wrote to memory of 612	2076	rundll32.exe	28
PID 612 wrote to memory of 2080	612	rundll32.exe	29
PID 612 wrote to memory of 2080	612	rundll32.exe	29
PID 612 wrote to memory of 2080	612	rundll32.exe	29
PID 612 wrote to memory of 2080	612	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 316
    3⤵
    - Program crash
    PID:2080