0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 20:54

Target

0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe
Size

477KB
MD5

0820583fb9d43b4641e397da05b20cb0
SHA1

7364f2907b77c6170c3191f43643a53d4b02b695
SHA256

0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553
SHA512

0e2f66b9b3b6e26a18f9c9cca291d954fdc5f12f4a231b2b9f8194c5c4f8677fb86648a2a1a0be7c0851006ece35873ce3f982213d1d086688fb6de3948ea925
SSDEEP

12288:wbXNrqSafvVjHadxm6p7Z/e0oTEm5+JJilScAnDm+rlY:wbX5qSSNu57sLTE0+HiQcgmwq

Score

8^/10

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\Beep.sys	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Beep.sys	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 1740	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	26

Program crash 1 IoCs

pid	pid_target	Process	procid_target
604	1344	WerFault.exe	17

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe
1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
460	Process not Found
460	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe
Token: SeDebugPrivilege	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1740	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	26
PID 1344 wrote to memory of 1740	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	26
PID 1344 wrote to memory of 1740	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	26
PID 1344 wrote to memory of 1740	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	26
PID 1344 wrote to memory of 1740	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	26
PID 1344 wrote to memory of 1740	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	26
PID 1344 wrote to memory of 604	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	27
PID 1344 wrote to memory of 604	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	27
PID 1344 wrote to memory of 604	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	27
PID 1344 wrote to memory of 604	1344	0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe	27

C:\Users\Admin\AppData\Local\Temp\0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe
"C:\Users\Admin\AppData\Local\Temp\0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" -fuck "C:\Users\Admin\AppData\Local\Temp\0ad74a818a4da24aa01c953da0136e4ffb6dd8e96c88bf5d8ec29fecf7679553.exe"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 240
  2⤵
  - Program crash
  PID:604

memory/1344-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download