e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 15:19

Target

e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d.dll
Size

397KB
MD5

9672b59762ab2fbb3505fbfdfab5f201
SHA1

3158ce7df371384dea6f3817e5f46282db2ccaed
SHA256

e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d
SHA512

dedf2268b42bd815efca75972beb70292548f7aac27f88af52c1b7a7467c33c56e7fe1b1a52c8a0ce30984c78c97607650e9dbc965ba654fa056f2a7ae5ecef1
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaB:174g2LDeiPDImOkx2LIaB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3900	4556	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	rundll32.exe
Token: SeTcbPrivilege	4556	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4556	2116	rundll32.exe	88
PID 2116 wrote to memory of 4556	2116	rundll32.exe	88
PID 2116 wrote to memory of 4556	2116	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 716
    3⤵
    - Program crash
    PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4556 -ip 4556
1⤵
PID:4080