e723ee615d7a64e918ab185b645324a0cb1b376302d33b54995b54da39be51f3

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 20:31

Target

RunDLL.dll
Size

90KB
MD5

3f1f6f320c3df5a4494924e9705028ed
SHA1

3b1474939fc2cc4c5396cfb0608fcba364b33f27
SHA256

db030ca1c54781fb0029dbe433bbc9de566350acc633ad3445ae81b56c0f2e8c
SHA512

1b066461a7329dfd54c78cb5c0538b065770abe64917d38f64177710b2bb2320c815f2115d26dfe5f7632cb6ac29da9687f774371e3c2fce04a2bb124d012726
SSDEEP

1536:+GEbOAarrqRAsNdkaHk13rMTHUEBDS8U+CSdr8AB55kDTNGcGHqxNC3Xty:QbOAamAgterMZe8Zr8ABDEoqxNC3k

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1780 2220 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2220 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 2220 rundll32.exe

pid	pid_target	process	target process
1780	2220	WerFault.exe	rundll32.exe

pid	process
2220	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2220	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1244 wrote to memory of 2220	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2220	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2220	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2220	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2220	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2220	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2220	1244	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 1780	2220	rundll32.exe	WerFault.exe
PID 2220 wrote to memory of 1780	2220	rundll32.exe	WerFault.exe
PID 2220 wrote to memory of 1780	2220	rundll32.exe	WerFault.exe
PID 2220 wrote to memory of 1780	2220	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RunDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RunDLL.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 296
    3⤵
    - Program crash
    PID:1780

memory/2220-0-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/2220-1-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download