b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c

Analysis

max time kernel
112s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 20:30

Target

b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c.exe
Size

1.5MB
MD5

5a657f1c90e69caf213aed6a6269011d
SHA1

3de941d8f607a6e953b6a423e158cf8a735cb5a4
SHA256

b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c
SHA512

9ed660bdb19d2c84ee289426003a55750698e7c88372b1367a659fe08a84832fea2005f2a6e6cbffdebb3d68fc9917caa362faec07c6f81cf7a3db7bdca648f0
SSDEEP

24576:FjWPFj4ku0k1MVAMB9mG7hpDIluC/IJTjTSYAaSbCf1U+SILFm4YS+Lhl8:FYvu4mzuCUSZS14ILFYLhl8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x000b000000022e30-132.dat	upx

Loads dropped DLL 1 IoCs

pid	Process
4632	b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	4632	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4632	b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c.exe
4632	b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c.exe
4632	b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c.exe

C:\Users\Admin\AppData\Local\Temp\b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c.exe
"C:\Users\Admin\AppData\Local\Temp\b6479c0fb9a42107451710add02e064f4d2df165f733e6170e13be0919afc21c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 844
  2⤵
  - Program crash
  PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4632 -ip 4632
1⤵
PID:3468

C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
216KB

MD5
30ba5996af6fbc4e7b47321327608620

SHA1
c4a7a9bc53085181b83f94f862e6708144060692

SHA256
a37f59942789a2c49575216689dced3ce96749523c49a02f166248e82314b38d

SHA512
8b3de624aae2745c9e12544392df1b19ea5abaee6ac2d9e3f1f6e2d1fe3ff3ae5f1980659ea0cf964c5321378bc1114d4f69a6f92071f110b0257d2fedec2056

Download Submit