2a3f928955893e6810408be597a7b15008d5b1999d1b70e3f7a73fcf8cddde58

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 19:39

Target

K8DLUtils.dll
Size

835KB
MD5

1cfa6b05d11ec2abe2169548f0c87379
SHA1

1de445a3c614ae3d21a4b05b14a5807f17bbc40e
SHA256

25d136cf467b9fcedc1d7a488e4200bfa0afb64b1e7c87537f0d48db921cfe62
SHA512

c05f944aed54ed8f711f84820eb04c0263b26a8b816c12f273f6375b38ec92c39d83a644719f3e104fb4b9fb5437a3afdbbff5f7a45637e8ccf5d75718e04339
SSDEEP

12288:WvM2iOZodhXN5ZvR1waEL6nAYNr9A2He0OwD:WE2iOEXDm8AeA2Hek

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	1784	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1784	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1784	2188	rundll32.exe	28
PID 2188 wrote to memory of 1784	2188	rundll32.exe	28
PID 2188 wrote to memory of 1784	2188	rundll32.exe	28
PID 2188 wrote to memory of 1784	2188	rundll32.exe	28
PID 2188 wrote to memory of 1784	2188	rundll32.exe	28
PID 2188 wrote to memory of 1784	2188	rundll32.exe	28
PID 2188 wrote to memory of 1784	2188	rundll32.exe	28
PID 1784 wrote to memory of 2660	1784	rundll32.exe	29
PID 1784 wrote to memory of 2660	1784	rundll32.exe	29
PID 1784 wrote to memory of 2660	1784	rundll32.exe	29
PID 1784 wrote to memory of 2660	1784	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K8DLUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\K8DLUtils.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 404
    3⤵
    - Program crash
    PID:2660

memory/1784-0-0x0000000002290000-0x00000000025B0000-memory.dmp

Filesize
3.1MB

Download