66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2

Analysis

max time kernel
1563s
max time network
1504s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Target

Resources/MagicPDF.dll
Size

2.7MB
MD5

d6483fac44e989285975f2f93e384ee4
SHA1

3ab591cc4b40c21926ce2e8d925082428cbdea3b
SHA256

c13ecf30f5f377813465ffd1585802f7126a21b7246a2f84629a4b0d0d9f210a
SHA512

861b95c9c21ac73848033111eeaee7079702fe00ddbb6c885fdd0b3403df88c5f063a2bdff482409c2bd5c308a88c098e357fa4001e9bbdc7621b3ca66efbab5
SSDEEP

49152:K9xuToSZMx5ypSBr4ZEkqIb3XM5dM4yThGTe7he:KgSBr4ZEkqIbHM5d50E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3724	4496	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1368	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4496	3760	rundll32.exe	83
PID 3760 wrote to memory of 4496	3760	rundll32.exe	83
PID 3760 wrote to memory of 4496	3760	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\MagicPDF.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\MagicPDF.dll,#1
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 676
    3⤵
    - Program crash
    PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4496 -ip 4496
1⤵
PID:3940

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

memory/1368-1-0x000001FD21840000-0x000001FD21850000-memory.dmp

Filesize
64KB

Download
memory/1368-17-0x000001FD21940000-0x000001FD21950000-memory.dmp

Filesize
64KB

Download
memory/1368-33-0x000001FD29CB0000-0x000001FD29CB1000-memory.dmp

Filesize
4KB

Download
memory/1368-35-0x000001FD29CE0000-0x000001FD29CE1000-memory.dmp

Filesize
4KB

Download
memory/1368-36-0x000001FD29CE0000-0x000001FD29CE1000-memory.dmp

Filesize
4KB

Download
memory/1368-37-0x000001FD29DF0000-0x000001FD29DF1000-memory.dmp

Filesize
4KB

Download
memory/4496-0-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download