83fb05b5d718254698ba698c1520ea9d31a96a9011922abbbe8eabac0c368cd1

Analysis

max time kernel
131s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:25

Target

83fb05b5d718254698ba698c1520ea9d31a96a9011922abbbe8eabac0c368cd1.dll
Size

2.4MB
MD5

51d4a742c20c873c50d031579d09931e
SHA1

e1621ab0ce0d1df05a6cc5289d672dc077d4b55b
SHA256

83fb05b5d718254698ba698c1520ea9d31a96a9011922abbbe8eabac0c368cd1
SHA512

ed413b90cc6ebdcb1dd5eae6434f55a1abaeae7a80fccf9b0997b0caeda73c0fffc36ba9b4073bd870b4a9a35c4a327404d17eb22a6f7ad2ad456bee57a87c1f
SSDEEP

49152:YSxOI7Yog1iCov4Z9okD0IIUnbD1qCFDt4TAKxjK:HLYogUCL9oi9ntqCF5a5xW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4816 2368 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 2368 rundll32.exe
Token: SeDebugPrivilege 2368 rundll32.exe
Token: SeDebugPrivilege 2368 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2368 rundll32.exe

pid	pid_target	process	target process
4816	2368	WerFault.exe	rundll32.exe

pid	process
2368	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2476 wrote to memory of 2368	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2368	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2368	2476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83fb05b5d718254698ba698c1520ea9d31a96a9011922abbbe8eabac0c368cd1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83fb05b5d718254698ba698c1520ea9d31a96a9011922abbbe8eabac0c368cd1.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 736
    3⤵
    - Program crash
    PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2368 -ip 2368
1⤵
PID:1484