e0ab6ef803903b6866fb2dcddf7352e06fedc088a2b8314f7829cc9f83f2a22e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 16:50

Target

CheckForUpdate.dll
Size

5.0MB
MD5

c750aa66281e93002b8d155d3a516568
SHA1

d623f551fa08b76fa87002139831fa369d5b6571
SHA256

5ef1e8fd70fca762804de304a2f01d460015a824e3fda3b3edb5cb01103f1497
SHA512

b9a5507c2ff3e05e70623306f9ef0476edcd9e0dad2e60b7de0aef374a5ba414246e5b6ff2c97ff8f8db5538dd0b9453c01289fa5444b2e94731377c94764148
SSDEEP

49152:V5E6ZIdMNWCwJX12xivHr1vSG4dgw9v2Y8vX9R6T8523EEc+HOwi4WCBsu4Bx1uG:7Zxi/j2z8vXw8wi4Tnn9

Score

5^/10

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dll\CheckForUpdate.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\symbols\exe\rundll32.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\dll\wntdll.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\DLL\wkernel32.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\CheckForUpdate.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\rundll32.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\exe\rundll32.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\CheckForUpdate.pdb	rundll32.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dll\CheckForUpdate.pdb	rundll32.exe
File opened for modification	C:\Windows\rundll32.pdb	rundll32.exe
File opened for modification	C:\Windows\dll\wntdll.pdb	rundll32.exe
File opened for modification	C:\Windows\wkernel32.pdb	rundll32.exe
File opened for modification	C:\Windows\symbols\DLL\wkernel32.pdb	rundll32.exe
File opened for modification	C:\Windows\CheckForUpdate.pdb	rundll32.exe
File opened for modification	C:\Windows\symbols\dll\CheckForUpdate.pdb	rundll32.exe
File opened for modification	C:\Windows\exe\rundll32.pdb	rundll32.exe
File opened for modification	C:\Windows\symbols\exe\rundll32.pdb	rundll32.exe
File opened for modification	C:\Windows\wntdll.pdb	rundll32.exe
File opened for modification	C:\Windows\symbols\dll\wntdll.pdb	rundll32.exe
File opened for modification	C:\Windows\DLL\wkernel32.pdb	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4160	1652	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1652	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1652	1020	rundll32.exe	84
PID 1020 wrote to memory of 1652	1020	rundll32.exe	84
PID 1020 wrote to memory of 1652	1020	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CheckForUpdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CheckForUpdate.dll,#1
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 832
    3⤵
    - Program crash
    PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1652 -ip 1652
1⤵
PID:3224

memory/1652-1-0x0000000002290000-0x00000000027B2000-memory.dmp

Filesize
5.1MB

Download
memory/1652-0-0x0000000002290000-0x00000000027B2000-memory.dmp

Filesize
5.1MB

Download
memory/1652-5-0x0000000002290000-0x00000000027B2000-memory.dmp

Filesize
5.1MB

Download