77f20e6f3d1cff78db2a51eec89d7ca95b686ecf95ed9a6d739dae10dfc820e3

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 12:50

Target

b770a4169799999d0cb175639c44c4c8.dll
Size

310KB
MD5

b770a4169799999d0cb175639c44c4c8
SHA1

b49ccd80dff2d0531ac329ca7dfc712a622f3a3c
SHA256

77f20e6f3d1cff78db2a51eec89d7ca95b686ecf95ed9a6d739dae10dfc820e3
SHA512

06588e150f7be848b0c0a2cfa26a44df3c193d883c8045feab8938394ab0f3211f5341a3031945b2dac4a084e9969fe8c114bc867e654819900ced13dd9cb9ff
SSDEEP

6144:5JNJHGFjevwYOW5Ki10Gjhd8Kd0bPVweldcky8eu:zqeIYOW5P10GgrbKKJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	1952	WerFault.exe	94

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1952	rundll32.exe
Token: SeSecurityPrivilege	1952	rundll32.exe
Token: SeTakeOwnershipPrivilege	1952	rundll32.exe
Token: SeLoadDriverPrivilege	1952	rundll32.exe
Token: SeSystemProfilePrivilege	1952	rundll32.exe
Token: SeSystemtimePrivilege	1952	rundll32.exe
Token: SeProfSingleProcessPrivilege	1952	rundll32.exe
Token: SeIncBasePriorityPrivilege	1952	rundll32.exe
Token: SeCreatePagefilePrivilege	1952	rundll32.exe
Token: SeShutdownPrivilege	1952	rundll32.exe
Token: SeDebugPrivilege	1952	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1952	rundll32.exe
Token: SeRemoteShutdownPrivilege	1952	rundll32.exe
Token: SeUndockPrivilege	1952	rundll32.exe
Token: SeManageVolumePrivilege	1952	rundll32.exe
Token: 33	1952	rundll32.exe
Token: 34	1952	rundll32.exe
Token: 35	1952	rundll32.exe
Token: 36	1952	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 1952	4832	rundll32.exe	94
PID 4832 wrote to memory of 1952	4832	rundll32.exe	94
PID 4832 wrote to memory of 1952	4832	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b770a4169799999d0cb175639c44c4c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b770a4169799999d0cb175639c44c4c8.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 636
    3⤵
    - Program crash
    PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1952 -ip 1952
1⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:2472

memory/1952-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1952-1-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/1952-2-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download