8e32c6bdd2bb98cb4ba166a60d5b5a9e6cf56ddd1122d7fa28ee677f2632071c

Analysis

max time kernel
131s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 00:35

Target

8e32c6bdd2bb98cb4ba166a60d5b5a9e6cf56ddd1122d7fa28ee677f2632071c.dll
Size

34KB
MD5

2983a9c4f8670a626a0b8f69bd47586c
SHA1

c42ec5b448ede6498f2a92c0550406f18af5407d
SHA256

8e32c6bdd2bb98cb4ba166a60d5b5a9e6cf56ddd1122d7fa28ee677f2632071c
SHA512

35e272b03217c4121762673445ba7d080ef567e3dd94f6d0b6337f671ec976f326a1175c10b7960908e1c1bc4ac0de12c6127c15eb0b4e72543d9935007c69ce
SSDEEP

768:FH3YA78rMnO/eKTlUNykrGCNIhMKFFimx+5GUL/R/ucQ:R4gnO/eKT+NydzWKji5V/Fu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	1068	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 1068	3436	rundll32.exe	83
PID 3436 wrote to memory of 1068	3436	rundll32.exe	83
PID 3436 wrote to memory of 1068	3436	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e32c6bdd2bb98cb4ba166a60d5b5a9e6cf56ddd1122d7fa28ee677f2632071c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e32c6bdd2bb98cb4ba166a60d5b5a9e6cf56ddd1122d7fa28ee677f2632071c.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 848
    3⤵
    - Program crash
    PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1068 -ip 1068
1⤵
PID:4512

memory/1068-2-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/1068-1-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/1068-0-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/1068-3-0x0000000077D02000-0x0000000077D03000-memory.dmp

Filesize
4KB

Download
memory/1068-4-0x0000000077D02000-0x0000000077D03000-memory.dmp

Filesize
4KB

Download