ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687

Resubmissions

06/04/2023, 22:39

31/01/2022, 03:40

Target

ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe
Size

390KB
MD5

f407b3f68d5603c74c810ba16c08ec9d
SHA1

0f3aac3d2ea898b4722d08dd6fcca0b9a861528b
SHA256

ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687
SHA512

c41ca7fd1e827ba819b77c2349c6fdc621d61437a37193700beb7888e8f51efe9f160fca801fae451c38243c47885864c08896cf93b18986bda9519ad9b9ccf3

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.ipify.org

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3696	3968	WerFault.exe	46

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe
Token: SeDebugPrivilege	3696	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe
"C:\Users\Admin\AppData\Local\Temp\ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3968 -s 1604
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3696

memory/3968-115-0x0000014AF5430000-0x0000014AF5498000-memory.dmp

Filesize
416KB

Download
memory/3968-116-0x0000014AF5790000-0x0000014AF582A000-memory.dmp

Filesize
616KB

Download
memory/3968-117-0x0000014AF7AB0000-0x0000014AF7AB2000-memory.dmp

Filesize
8KB

Download