91c3b2b0be1ba25c0234fed681c1506e6396624d019c4e8626da7fd7d55c3694

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-03-2023 01:41

Target

ykuBL9i61d.exe
Size

729KB
MD5

5a6e2372cf092d16435162af7b23de62
SHA1

e4c1e54aca0eacc3675bd7db4ec92f11979aefcb
SHA256

91c3b2b0be1ba25c0234fed681c1506e6396624d019c4e8626da7fd7d55c3694
SHA512

d5029c0e6d31d9e8526e7ef3cd28743c45ae0971bbc642bcbb73e8a9f99a5dc6174598542e93b49bb38651a0c11dc3e9fe0fc759e40a0e5564cb5e7ef29dbb60
SSDEEP

12288:srto7EbSb958GjpjDK4i0oAGqj+3hPebgB2iFnDT+bKOwONz5J5JrRjH:srtoYbSb958gjugoAGZhPGgIubAd9Jrd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

ykuBL9i61d.exe

description pid process target process

PID 1772 set thread context of 1512 1772 ykuBL9i61d.exe Setup.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1588 1512 WerFault.exe Setup.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ykuBL9i61d.exe

pid process

1772 ykuBL9i61d.exe
1772 ykuBL9i61d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ykuBL9i61d.exe

description pid process

Token: SeDebugPrivilege 1772 ykuBL9i61d.exe

description	pid	process	target process
PID 1772 set thread context of 1512	1772	ykuBL9i61d.exe	Setup.exe

pid	pid_target	process	target process
1588	1512	WerFault.exe	Setup.exe

pid	process
1772	ykuBL9i61d.exe
1772	ykuBL9i61d.exe

description	pid	process
Token: SeDebugPrivilege	1772	ykuBL9i61d.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

ykuBL9i61d.exeSetup.exe

description	pid	process	target process
PID 1772 wrote to memory of 1764	1772	ykuBL9i61d.exe	jsc.exe
PID 1772 wrote to memory of 1764	1772	ykuBL9i61d.exe	jsc.exe
PID 1772 wrote to memory of 1764	1772	ykuBL9i61d.exe	jsc.exe
PID 1772 wrote to memory of 1764	1772	ykuBL9i61d.exe	jsc.exe
PID 1772 wrote to memory of 1564	1772	ykuBL9i61d.exe	csc.exe
PID 1772 wrote to memory of 1564	1772	ykuBL9i61d.exe	csc.exe
PID 1772 wrote to memory of 1564	1772	ykuBL9i61d.exe	csc.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1772 wrote to memory of 1512	1772	ykuBL9i61d.exe	Setup.exe
PID 1512 wrote to memory of 1588	1512	Setup.exe	WerFault.exe
PID 1512 wrote to memory of 1588	1512	Setup.exe	WerFault.exe
PID 1512 wrote to memory of 1588	1512	Setup.exe	WerFault.exe
PID 1512 wrote to memory of 1588	1512	Setup.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:1764

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:1564

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 304
3⤵
- Program crash
PID:1588

memory/1512-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-54-0x0000000000FF0000-0x00000000010AA000-memory.dmp

Filesize
744KB

Download
memory/1772-55-0x000000001ADE0000-0x000000001AE96000-memory.dmp

Filesize
728KB

Download
memory/1772-56-0x00000000009C0000-0x0000000000A40000-memory.dmp

Filesize
512KB

Download