126b0c2e7314b62e508e6906fe14a93165bfbcaa6c20aed8c9e952d8919af171

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 03:33

Target

c7950ed1dfbad7b4593c1c27a967059d.dll
Size

18KB
MD5

c7950ed1dfbad7b4593c1c27a967059d
SHA1

0f0224cf1120cfdb56bb96051063527382454b8a
SHA256

126b0c2e7314b62e508e6906fe14a93165bfbcaa6c20aed8c9e952d8919af171
SHA512

c12d5b69b2bd68fe13244ead1efacb623bf81c4d711fbb1b31236a6f314d7b2b19a5c6932e5fa11972832a663d5735a82c9b38d6e3fd22101bd4340a9d7dda41
SSDEEP

384:ufvQ9qPcCeyicT/E0DbZ5/4Kg9DSXjbpHWPUgSNNWVE:uvAqz/E0YN9DSXQyW

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\netsrvcs.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\netsrvcs.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2828	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	rundll32.exe
2828	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2828	1224	rundll32.exe	97
PID 1224 wrote to memory of 2828	1224	rundll32.exe	97
PID 1224 wrote to memory of 2828	1224	rundll32.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7950ed1dfbad7b4593c1c27a967059d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7950ed1dfbad7b4593c1c27a967059d.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 652
    3⤵
    - Program crash
    PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2828 -ip 2828
1⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3952 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2388

memory/2828-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2828-1-0x0000000000690000-0x0000000000692000-memory.dmp

Filesize
8KB

Download
memory/2828-3-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download