d8a494eb251d65dc386f628c81e944e525007d12aa2164dcc5eb27107619de9c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 11:23

Target

b49553fb59dafdf81a1f810fc7efaa45.dll
Size

88KB
MD5

b49553fb59dafdf81a1f810fc7efaa45
SHA1

5efd1c5fd343b766c170dd14ee17590422d8e2bd
SHA256

d8a494eb251d65dc386f628c81e944e525007d12aa2164dcc5eb27107619de9c
SHA512

a7a64bcd96e6f4f57daf4d4b4e4f915dbfe6197dffb48e9ee3d028de588a7b681eb70ac88474443b3b7d35ec5502bd8235618c110c2863f24bdac13327f5d239
SSDEEP

768:ALH9K+whSN4WW76ekZeqSy8nRt56v1cyZySJzkTcfFRC0ShENx3EFj5Z1TrxPdW8:ApHqN6tCnD5fCzffFRm+PEVTnx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4852	3104	WerFault.exe	91

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3104	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3104	3720	rundll32.exe	91
PID 3720 wrote to memory of 3104	3720	rundll32.exe	91
PID 3720 wrote to memory of 3104	3720	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b49553fb59dafdf81a1f810fc7efaa45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b49553fb59dafdf81a1f810fc7efaa45.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 832
    3⤵
    - Program crash
    PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3104 -ip 3104
1⤵
PID:4924