8beea44520f307488f94d04241245ac943e2013f165308bac4277efae326c060

Analysis

max time kernel
101s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2022 23:33

Target

1b1bae0b503d1aa9d659db31ed2cd208.exe
Size

401KB
MD5

1b1bae0b503d1aa9d659db31ed2cd208
SHA1

a0a740dabdb48f1ec5665f9ee6026734e5d6d044
SHA256

8beea44520f307488f94d04241245ac943e2013f165308bac4277efae326c060
SHA512

e960612d89779f9d80eb683a7f89acf43116131adab7044b9f2bd66b613afd1e8e83dc26a76424875b6f281265d93d17f63e8d288346e613658a386552c10d06
SSDEEP

6144:YKdKe+GXmr07DPIE5e20BnJSpY2vGo/WEVSMofYZzPtWMIvA1h7OHpjo9KK:YOkFr07d5e5gVLVPtW/Y1h7mp

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 2196	1112	1b1bae0b503d1aa9d659db31ed2cd208.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	1112	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 2196	1112	1b1bae0b503d1aa9d659db31ed2cd208.exe	82
PID 1112 wrote to memory of 2196	1112	1b1bae0b503d1aa9d659db31ed2cd208.exe	82
PID 1112 wrote to memory of 2196	1112	1b1bae0b503d1aa9d659db31ed2cd208.exe	82
PID 1112 wrote to memory of 2196	1112	1b1bae0b503d1aa9d659db31ed2cd208.exe	82
PID 1112 wrote to memory of 2196	1112	1b1bae0b503d1aa9d659db31ed2cd208.exe	82

C:\Users\Admin\AppData\Local\Temp\1b1bae0b503d1aa9d659db31ed2cd208.exe
"C:\Users\Admin\AppData\Local\Temp\1b1bae0b503d1aa9d659db31ed2cd208.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 256
  2⤵
  - Program crash
  PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1112 -ip 1112
1⤵
PID:2504

memory/1112-135-0x0000000000350000-0x00000000003BB000-memory.dmp

Filesize
428KB

Download
memory/2196-133-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2196-139-0x00000000080A0000-0x0000000008644000-memory.dmp

Filesize
5.6MB

Download
memory/2196-140-0x0000000007B90000-0x0000000007C22000-memory.dmp

Filesize
584KB

Download
memory/2196-141-0x0000000007B60000-0x0000000007B6A000-memory.dmp

Filesize
40KB

Download
memory/2196-142-0x000000000A9F0000-0x000000000AA56000-memory.dmp

Filesize
408KB

Download