50961457a4105a4de1262a8aca010320f80b0ede52431d6e229b3280582670ab

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 10:56

Target

50961457a4105a4de1262a8aca010320f80b0ede52431d6e229b3280582670ab.dll
Size

23KB
MD5

1029d5c1bd1207ec7ce24091fd26342d
SHA1

486e2509264e180df7fa746cebab48445398604b
SHA256

50961457a4105a4de1262a8aca010320f80b0ede52431d6e229b3280582670ab
SHA512

db539b01b21fd648ca7d56321b9a226d51d1db3a5e25eef2d552eb53e6f58b3fd495fccd96e1a19f3072f2c332dfd6a9edcd04d88d78a9fb8a32d7b075e9b2bd
SSDEEP

384:1mgGC33UOjgxUw6gGfgSeF/l7+dIM+tETIawY258z:4ghHJYTRHVETIlY25

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	3112	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	3112	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3112	rundll32.exe
3112	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3112	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3112	4128	rundll32.exe	86
PID 4128 wrote to memory of 3112	4128	rundll32.exe	86
PID 4128 wrote to memory of 3112	4128	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50961457a4105a4de1262a8aca010320f80b0ede52431d6e229b3280582670ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50961457a4105a4de1262a8aca010320f80b0ede52431d6e229b3280582670ab.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 716
    3⤵
    - Program crash
    PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3112 -ip 3112
1⤵
PID:3452