ea32d0548dffc8a6f58ffef4c850e2d5613eacdf2012bf4321ecf49bf69f2025

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 01:47

Target

ea32d0548dffc8a6f58ffef4c850e2d5613eacdf2012bf4321ecf49bf69f2025.dll
Size

434KB
MD5

22b89b54fb8fed7df6fc0c60ffc9d3ae
SHA1

e95fd58f5b92ef07859ee32efd7ce0ba96cc109a
SHA256

ea32d0548dffc8a6f58ffef4c850e2d5613eacdf2012bf4321ecf49bf69f2025
SHA512

fc1f4a90754c66499abce664f1e4ab7494a9a5d17845d059e92a81935fb7e487afa3a16574da3b9dc628ef4acd55d5c83d8a6068566290662a4a57a76041c5d8
SSDEEP

12288:mIxPg1oEcXyGQRQ9RgU1t6MMooOWL0Hns9Jdu8TmFaYJhdjq:mtm96I5dWL79JSPq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4268	4440	WerFault.exe	91

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	rundll32.exe
Token: SeLoadDriverPrivilege	4440	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4440	3484	rundll32.exe	91
PID 3484 wrote to memory of 4440	3484	rundll32.exe	91
PID 3484 wrote to memory of 4440	3484	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea32d0548dffc8a6f58ffef4c850e2d5613eacdf2012bf4321ecf49bf69f2025.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea32d0548dffc8a6f58ffef4c850e2d5613eacdf2012bf4321ecf49bf69f2025.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 752
    3⤵
    - Program crash
    PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4440 -ip 4440
1⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4292 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:448