0f33c9b99144f622bd46336699e96162d67ac8e7c981ccc272a1294959d72739

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 18:41

Target

0f33c9b99144f622bd46336699e96162d67ac8e7c981ccc272a1294959d72739.dll
Size

34KB
MD5

acd660e04b24efc6ac0ef865f5a7bb8c
SHA1

f3844aec3d7803d8d0f5e63dc42255d0951ebfc9
SHA256

0f33c9b99144f622bd46336699e96162d67ac8e7c981ccc272a1294959d72739
SHA512

1ab5e7025226636aa5f9768213c2e580aa4a8735112382cebdd9676421a54d059de124e748b6da49a287d1783c1080807d4d6a36871fe1232eb2618833ad3a89
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRtjQ:UcwnO/iP5lPOdgWtJxsL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4656	5072	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 5072	4988	rundll32.exe	82
PID 4988 wrote to memory of 5072	4988	rundll32.exe	82
PID 4988 wrote to memory of 5072	4988	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f33c9b99144f622bd46336699e96162d67ac8e7c981ccc272a1294959d72739.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f33c9b99144f622bd46336699e96162d67ac8e7c981ccc272a1294959d72739.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 824
    3⤵
    - Program crash
    PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5072 -ip 5072
1⤵
PID:4996

memory/5072-0-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/5072-2-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/5072-1-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

Filesize
4KB

Download
memory/5072-3-0x0000000077462000-0x0000000077463000-memory.dmp

Filesize
4KB

Download
memory/5072-4-0x0000000077462000-0x0000000077463000-memory.dmp

Filesize
4KB

Download