3065df9608a4d29f1cc7f4934ecd7445d83f6e5ecde5b7f8ecca656a7c384657

Analysis

max time kernel
173s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 19:28

Target

a5a4b316cc349db892a27c9b5429dd4e.exe
Size

29KB
MD5

a5a4b316cc349db892a27c9b5429dd4e
SHA1

18e025e751a08d3af69bf8fbe26939bfa96c1668
SHA256

3065df9608a4d29f1cc7f4934ecd7445d83f6e5ecde5b7f8ecca656a7c384657
SHA512

a22fe0c4890acd1e72f3fc9fb95f22b4032473c37e86613ed6a7cde529286703132f186946294225b74ec8a69358d71a617ccda7bcaf5cf1603cf954d10bf7d6
SSDEEP

384:IUsQruz2H58mIajRgJTQo5pkvwKwq6u/FB:IGr42Z8c9vn

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe	a5a4b316cc349db892a27c9b5429dd4e.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1360	4196	WerFault.exe	78
1100	4196	WerFault.exe	78

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	a5a4b316cc349db892a27c9b5429dd4e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 1360	4196	a5a4b316cc349db892a27c9b5429dd4e.exe	83
PID 4196 wrote to memory of 1360	4196	a5a4b316cc349db892a27c9b5429dd4e.exe	83
PID 4196 wrote to memory of 1360	4196	a5a4b316cc349db892a27c9b5429dd4e.exe	83

C:\Users\Admin\AppData\Local\Temp\a5a4b316cc349db892a27c9b5429dd4e.exe
"C:\Users\Admin\AppData\Local\Temp\a5a4b316cc349db892a27c9b5429dd4e.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 1472
  2⤵
  - Program crash
  PID:1360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 1472
  2⤵
  - Program crash
  PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4196 -ip 4196
1⤵
PID:2376

memory/4196-132-0x00000000002D0000-0x00000000002DE000-memory.dmp

Filesize
56KB

Download
memory/4196-133-0x00000000051B0000-0x0000000005754000-memory.dmp

Filesize
5.6MB

Download
memory/4196-134-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download