19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 17:03

Target

19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe
Size

244KB
MD5

a5babd8d1f956171ec86accfb29390b9
SHA1

5173a227d44217f49e49fc03e012916744569e41
SHA256

19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3
SHA512

db31f3ec31c7d44c6ad31fc9b7cb19909987fcbc943789d43a7ea055ec25e310917e48540e4cb0a70e2ad68e8356545229ed947e5a5b8e45bf6a7aacd1fe3625
SSDEEP

3072:qR2qXJTwoUl1lPya245z3vfdHldhwR+OGa0A9/JRJivjXrgk5aAPI44rx1Oya33a:qhFqf124usM4+x1OyaH03Aht4

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 4872	5072	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	76
PID 4872 set thread context of 1864	4872	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	77

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	1864	WerFault.exe	77

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4872	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4872	5072	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	76
PID 5072 wrote to memory of 4872	5072	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	76
PID 5072 wrote to memory of 4872	5072	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	76
PID 5072 wrote to memory of 4872	5072	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	76
PID 5072 wrote to memory of 4872	5072	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	76
PID 4872 wrote to memory of 1864	4872	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	77
PID 4872 wrote to memory of 1864	4872	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	77
PID 4872 wrote to memory of 1864	4872	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	77
PID 4872 wrote to memory of 1864	4872	19873c20e95f96b17e46b177f188b9cd7ae7432a55cfd4063d45400e91ffd3d3.exe	77

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1864 -ip 1864
1⤵
PID:1216

memory/4872-134-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4872-136-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4872-140-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4872-143-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5072-132-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/5072-137-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download