e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 20:15

Target

e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
Size

29KB
MD5

a3660559550e79d5607ced7e2bef5890
SHA1

b12fa4f57254fcc38262c49410d7b505da7a975c
SHA256

e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9
SHA512

3e1bdab1acf9ce7c050fbb9d083fc800a9eef92435514084b7e2ee2c6e66e00c2a31c1d53dfa2074b2eae62cd65c78cbd07421ac96dcae8dcbcf3d15721fd9e7
SSDEEP

384:TFDiowin12+Rg8rTdM9HTtJjGpvUOJ+yTTfzPnYeXd4R55S8UwUAZIVHNgCa:TFDdcR8eJ+NJJTvJsS8jNuH

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2060-132-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msimg32.dll	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File created	C:\Windows\SysWOW64\msimg32.dll	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File created	C:\Windows\SysWOW64\tmd953	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File opened for modification	C:\Windows\SysWOW64\tmd953	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\msimg32.dll	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File created	C:\Windows\SysWOW64\TYd3d8.dll	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File created	C:\Windows\SysWOW64\TYmsimg32.dll	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File opened for modification	C:\Windows\SysWOW64\TYmsimg32.dll	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File created	C:\Windows\SysWOW64\aaa_953	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
File opened for modification	C:\Windows\SysWOW64\aaa_953	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
392	2060	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2060	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
2060	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe

C:\Users\Admin\AppData\Local\Temp\e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe
"C:\Users\Admin\AppData\Local\Temp\e7049c2eaf3705a0ca0d3652caa3eb9587e2317614159689f49a0d9bd6992fd9.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 544
  2⤵
  - Program crash
  PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2060 -ip 2060
1⤵
PID:4368

memory/2060-132-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download