87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71

Analysis

max time kernel
352s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 07:32

Target

87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
Size

270KB
MD5

8c98321d11ba3cba413ec83137a771eb
SHA1

e46a50a88607fcd81c269654e3a66d2db209090c
SHA256

87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71
SHA512

e46daf37cf10f6059075717fab4b451fc13d440201d2cd515cb774959fe667768fad036e8c67141cb2d8e18eea3a8ca425b0811e1960269bdda88e7da8139ff2
SSDEEP

3072:7InbvjRNubSRbSIYGae/Cccguu5JDB+ulFI2xIYnVs2ttoIfdegnC1kfooMSz5/2:MQisccTu5hB+B2PW2EGxP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

description	pid	process	target process
PID 3848 set thread context of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

pid process

3848 87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

description pid process

Token: SeDebugPrivilege 3848 87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

pid process

1504 87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

pid	process
3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

description	pid	process
Token: SeDebugPrivilege	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

pid	process
1504	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

description	pid	process	target process
PID 3848 wrote to memory of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
PID 3848 wrote to memory of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
PID 3848 wrote to memory of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
PID 3848 wrote to memory of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
PID 3848 wrote to memory of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
PID 3848 wrote to memory of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
PID 3848 wrote to memory of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
PID 3848 wrote to memory of 1504	3848	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe	87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe

C:\Users\Admin\AppData\Local\Temp\87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
C:\Users\Admin\AppData\Local\Temp\87754b380449b36cf4bee20326ce587b693d6034c9cde9dab6a68465132fbf71.exe
2⤵
- Suspicious use of UnmapMainImage
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1504 -ip 1504
1⤵
PID:1240

memory/1504-132-0x0000000000000000-mapping.dmp

Download
memory/1504-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3848-134-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Filesize
5.7MB

Download
memory/3848-135-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Filesize
5.7MB

Download