16e23671e95df4da9cd4dbd0316d0aed1412e728f3358862535f0ef668873bb1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 17:32

Target

bc65aa5cd4fa1b258fb6e83969418e31.dll
Size

80KB
MD5

bc65aa5cd4fa1b258fb6e83969418e31
SHA1

e3c0eeed7a08caf519e7fd37d569946232316357
SHA256

16e23671e95df4da9cd4dbd0316d0aed1412e728f3358862535f0ef668873bb1
SHA512

4181c8d78ed687fe58862600793f1a4cab60032999343530b1a5a27ad58e003737929643286f34b78cfd1014ff1cf0cd3bbe958845f5d6f6ab44c5675af9d46a
SSDEEP

768:1HcIs09x4jELmuIcKhSnCD2ANuJx98XrNBeNwI:KIs00jCmuLKkh9mBWw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	1260	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1260	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1260	1676	rundll32.exe	28
PID 1676 wrote to memory of 1260	1676	rundll32.exe	28
PID 1676 wrote to memory of 1260	1676	rundll32.exe	28
PID 1676 wrote to memory of 1260	1676	rundll32.exe	28
PID 1676 wrote to memory of 1260	1676	rundll32.exe	28
PID 1676 wrote to memory of 1260	1676	rundll32.exe	28
PID 1676 wrote to memory of 1260	1676	rundll32.exe	28
PID 1260 wrote to memory of 2756	1260	rundll32.exe	29
PID 1260 wrote to memory of 2756	1260	rundll32.exe	29
PID 1260 wrote to memory of 2756	1260	rundll32.exe	29
PID 1260 wrote to memory of 2756	1260	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc65aa5cd4fa1b258fb6e83969418e31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc65aa5cd4fa1b258fb6e83969418e31.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 320
    3⤵
    - Program crash
    PID:2756