f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87

Analysis

max time kernel
300s
max time network
372s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:55

Target

f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
Size

28KB
MD5

0dff44bae805bb420d88ff51c2be3591
SHA1

f15870b10ad3ab41e2da6fc2d8f9287c879b963f
SHA256

f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87
SHA512

b6a3479fd773583e45aafbf9974ca8aa972eb69c8377162cb5cb641e0b786de2b8fa4cdecb56e50cae5bce4108945ebc15d8b481057b5f82468c887ef42e027a
SSDEEP

768:QFDdi4MM/y8zSf+h3kJ9IcaH6R8yDam+UP0L:pH+f6W6NMUP0L

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5016-132-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/5016-133-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\aaa_625	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\msimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\msimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\msimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\tmd625	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\TYmsimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\TYmsimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\tmd625	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\aaa_625	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\TYd3d8.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4452	5016	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
5016	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe

C:\Users\Admin\AppData\Local\Temp\f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
"C:\Users\Admin\AppData\Local\Temp\f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 556
  2⤵
  - Program crash
  PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5016 -ip 5016
1⤵
PID:4412

memory/5016-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5016-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download