5ca87d23b76747cc2710bede0dd15ca05f21e1ca1df959e95aebf49304a677a0

General

Target

d949b2a7fc1633e57f1afa34cd0a90a8.exe
Size

465KB
MD5

d949b2a7fc1633e57f1afa34cd0a90a8
SHA1

76b705a243bf5012be62d8789f4271e4de4b0547
SHA256

5ca87d23b76747cc2710bede0dd15ca05f21e1ca1df959e95aebf49304a677a0
SHA512

07b7eae9c5555ab25f703e0bf40b414f79322b78f049d8da9ee8d7bfdc6ab9339bad42fa572b3018b5319b74a76bec998eb18a4eed0febe22952f3b6126a4013

Score

9^/10

Core1 .NET packer 1 IoCs

Detects packer/loader used by .NET malware.

Processes:

resource	yara_rule
behavioral2/memory/1808-119-0x000000001CF40000-0x000000001CFE7000-memory.dmp	Core1

Loads dropped DLL 1 IoCs

Processes:

explorer.exe

pid process

2924 explorer.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

d949b2a7fc1633e57f1afa34cd0a90a8.exe

description pid process target process

PID 1808 set thread context of 2924 1808 d949b2a7fc1633e57f1afa34cd0a90a8.exe explorer.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1292 2924 WerFault.exe explorer.exe

pid	process
2924	explorer.exe

description	pid	process	target process
PID 1808 set thread context of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe

pid	pid_target	process	target process
1292	2924	WerFault.exe	explorer.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1292 WerFault.exe
Token: SeBackupPrivilege 1292 WerFault.exe
Token: SeDebugPrivilege 1292 WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d949b2a7fc1633e57f1afa34cd0a90a8.exe

description	pid	process	target process
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	explorer.exe

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
- Loads dropped DLL
PID:2924

\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
memory/1808-114-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1808-116-0x000000001C1F0000-0x000000001C2CF000-memory.dmp

Filesize
892KB

Download
memory/1808-117-0x000000001C330000-0x000000001C332000-memory.dmp

Filesize
8KB

Download
memory/1808-118-0x000000001D110000-0x000000001D111000-memory.dmp

Filesize
4KB

Download
memory/1808-119-0x000000001CF40000-0x000000001CFE7000-memory.dmp

Filesize
668KB

Download
memory/1808-120-0x0000000001050000-0x0000000001060000-memory.dmp

Filesize
64KB

Download
memory/1808-121-0x0000000001060000-0x0000000001061000-memory.dmp

Filesize
4KB

Download
memory/1808-122-0x0000000003180000-0x0000000003210000-memory.dmp

Filesize
576KB

Download
memory/2924-123-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2924-124-0x000000000043DC85-mapping.dmp

Download
memory/2924-125-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download