2ec4651c25eae0394a347ad3dc16c5c9647e13c624969392001e424ddf0a9a7c

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2022 08:24

Target

2ec4651c25eae0394a347ad3dc16c5c9647e13c624969392001e424ddf0a9a7c.exe
Size

273KB
MD5

30b485a831a5dd28b3e6905fb7c93b17
SHA1

bdafaa2a215f83e7a934eb5f6a032623bc86b15c
SHA256

2ec4651c25eae0394a347ad3dc16c5c9647e13c624969392001e424ddf0a9a7c
SHA512

252056db641cc2c62eb0e0bad6452cf8859f8876512006a2131d1bc2f9a67a45dc59dd85b6c22cab24433841ff4cea5327bead07040ef6fa3b0c1b5e6f5eb610
SSDEEP

6144:oTKGJ4pXPVreZyOZzh9CI4l4DlhZbsIHdo1qBAEft0z:gveXPV0ywPCIPhbo6AH

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4412	exploret.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 1648	4412	exploret.exe	80

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\exploret.exe	2ec4651c25eae0394a347ad3dc16c5c9647e13c624969392001e424ddf0a9a7c.exe
File opened for modification	C:\Windows\exploret.exe	2ec4651c25eae0394a347ad3dc16c5c9647e13c624969392001e424ddf0a9a7c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	1648	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	2ec4651c25eae0394a347ad3dc16c5c9647e13c624969392001e424ddf0a9a7c.exe
Token: SeDebugPrivilege	4412	exploret.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1648	4412	exploret.exe	80
PID 4412 wrote to memory of 1648	4412	exploret.exe	80
PID 4412 wrote to memory of 1648	4412	exploret.exe	80
PID 4412 wrote to memory of 1648	4412	exploret.exe	80
PID 4412 wrote to memory of 1648	4412	exploret.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1648 -ip 1648
1⤵
PID:3468

C:\Windows\exploret.exe

Filesize
273KB

MD5
30b485a831a5dd28b3e6905fb7c93b17

SHA1
bdafaa2a215f83e7a934eb5f6a032623bc86b15c

SHA256
2ec4651c25eae0394a347ad3dc16c5c9647e13c624969392001e424ddf0a9a7c

SHA512
252056db641cc2c62eb0e0bad6452cf8859f8876512006a2131d1bc2f9a67a45dc59dd85b6c22cab24433841ff4cea5327bead07040ef6fa3b0c1b5e6f5eb610

Download Submit
C:\Windows\exploret.exe

Filesize
273KB

MD5
30b485a831a5dd28b3e6905fb7c93b17

SHA1
bdafaa2a215f83e7a934eb5f6a032623bc86b15c

SHA256
2ec4651c25eae0394a347ad3dc16c5c9647e13c624969392001e424ddf0a9a7c

SHA512
252056db641cc2c62eb0e0bad6452cf8859f8876512006a2131d1bc2f9a67a45dc59dd85b6c22cab24433841ff4cea5327bead07040ef6fa3b0c1b5e6f5eb610

Download Submit
memory/1648-137-0x0000000000000000-mapping.dmp

Download
memory/1648-138-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2492-132-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2492-133-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2492-140-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4412-136-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4412-139-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download