a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656

Resubmissions

16-10-2022 11:09

16-10-2022 10:47

max time kernel
99s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2022 11:09

Target

a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656.exe
Size

32KB
MD5

95e4e49041a8667da55120c59a3ef878
SHA1

b6ae7491a63d48d9f419b9b0550ea2c565cb51d4
SHA256

a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656
SHA512

a3d4ced532826706942abae26144e1029ac8ca7631014e373d9ac85cd37a0f20568eebc8e668f71c1fc921974956208c43cdef619da4916299bab1a891ea84bf
SSDEEP

768:EAcFDuraYSDmPcYeFed7DGtM6niRGp9E+Mo:3cIa/DMcYeS4pioQ+Mo

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral2/memory/2572-132-0x0000000000700000-0x000000000070C000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2788 2572 WerFault.exe a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656.exe

description pid process

Token: SeDebugPrivilege 2572 a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656.exe

pid	pid_target	process	target process
2788	2572	WerFault.exe	a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656.exe

description	pid	process
Token: SeDebugPrivilege	2572	a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656.exe

C:\Users\Admin\AppData\Local\Temp\a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656.exe
"C:\Users\Admin\AppData\Local\Temp\a5d1051d46d03cf4ef648c7dd5426e5efc7e24a9fa37116e6d0324f462c06656.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 1664
2⤵
- Program crash
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2572 -ip 2572
1⤵
PID:4980

memory/2572-132-0x0000000000700000-0x000000000070C000-memory.dmp

Filesize
48KB

Download