3f9b96a275740546e4fdab1233d7e6da80a86877ab669cfcf4556d6049f161d2

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:40

Target
3f9b96a275740546e4fdab1233d7e6da80a86877ab669cfcf4556d6049f161d2.dll
Size 756KB
Sample240603-s37qcsbb5y
SHA256 3f9b96a275740546e4fdab1233d7e6da80a86877ab669cfcf4556d6049f161d2
MD5 d60d7584d900e8ed3f868282bc653762
SHA1 6a77fa780ae2a066ecfac3507333c963f1e441f8
SHA512 f58b478cd33fb04a8f400831657663cc17e8bfbf51856beca6e1d7e1adbe6c3188401d78fd576d3422b35faf70420da478392b8080a1ddfa65a1ea0c54a252d9
SSDEEP 12288:cGSHqMhgdrgdGHL3wHlCX4g0qtWUSSv2Rq0E2Tb6:cGfMCdrsGr3wHYIgRtWU5vQqhQb6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4680	1788	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1788	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1788	1396	rundll32.exe	83
PID 1396 wrote to memory of 1788	1396	rundll32.exe	83
PID 1396 wrote to memory of 1788	1396	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f9b96a275740546e4fdab1233d7e6da80a86877ab669cfcf4556d6049f161d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f9b96a275740546e4fdab1233d7e6da80a86877ab669cfcf4556d6049f161d2.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 692
    3⤵
    - Program crash
    PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1788 -ip 1788
1⤵
PID:640