22c9df4f8296c973127632fe0f772c3a504e3320ac570b681c278a3fe00799a0

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 03:21

Target

aadffe19be59508f5190c40d28710b7c.dll
Size

12KB
MD5

aadffe19be59508f5190c40d28710b7c
SHA1

11f0d8e41654f36fee5e4f02354f3bb143f1bffa
SHA256

22c9df4f8296c973127632fe0f772c3a504e3320ac570b681c278a3fe00799a0
SHA512

3c33c8735a035eeda1539ccde8986d0c06442b50aa2d6cb5b051ade7c9c0962c835535db7478fee3738c9a0c88767997ef1a88eaadbd17bccd3b4eff18d5878e
SSDEEP

192:hcVCAgNF+2ori0/fTfBQcgBr8mD7wYCFVOSOX82sn7ZjE:hAgNWtjBYBrJ7ELOSndn76

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4160	620	WerFault.exe	75

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 620	1440	rundll32.exe	75
PID 1440 wrote to memory of 620	1440	rundll32.exe	75
PID 1440 wrote to memory of 620	1440	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aadffe19be59508f5190c40d28710b7c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aadffe19be59508f5190c40d28710b7c.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 684
    3⤵
    - Program crash
    PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 620 -ip 620
1⤵
PID:3580