fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 15:05

Target

fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43.dll
Size

23KB
MD5

957417a6c595a6a08d2d3b4d6513a83e
SHA1

42ed96c7b3ced84296326bb53c87bec606a7169f
SHA256

fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43
SHA512

d81b3e8101b3d3e4ff0ad364aa63d5d672ecd87ea1fddc833c43ba136be15766b13238f31c58a372cfcc0119f12c2b89e548afb55e59c23bfad62152ef173404
SSDEEP

384:vxG1y3CF9dItBR88LTWdS+1ie//JQ4bitHdtFuFLdIM+tETIaIO58f:pLyF9dx8/L4GtHdtFuFKVETI5O5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	2884	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2884	2912	rundll32.exe	28
PID 2912 wrote to memory of 2884	2912	rundll32.exe	28
PID 2912 wrote to memory of 2884	2912	rundll32.exe	28
PID 2912 wrote to memory of 2884	2912	rundll32.exe	28
PID 2912 wrote to memory of 2884	2912	rundll32.exe	28
PID 2912 wrote to memory of 2884	2912	rundll32.exe	28
PID 2912 wrote to memory of 2884	2912	rundll32.exe	28
PID 2884 wrote to memory of 1488	2884	rundll32.exe	29
PID 2884 wrote to memory of 1488	2884	rundll32.exe	29
PID 2884 wrote to memory of 1488	2884	rundll32.exe	29
PID 2884 wrote to memory of 1488	2884	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 320
    3⤵
    - Program crash
    PID:1488