0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/04/2023, 04:47

Target

0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe
Size

301KB
MD5

b1f5b6125991825cfb4a06104499b3ed
SHA1

c46a5fbbf1f9262fe4d7f08d507ec41de96fc9ae
SHA256

0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1
SHA512

798d1318a82bfaf24f42aaf4fee87c7d148bf9210bb5a889304026b9723520f9972073dbd37ee61f90293e5bba7576911f9a5ef9b5685d56e0ce5fbfc394029c
SSDEEP

6144:ZgKilj8OGsaOzcDLwjaGUxYM8wS3Y3avn4udWglY:ZFit8OGt6cP2ajZPK4ud

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1772 set thread context of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1772	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
932	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 932	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	29
PID 1772 wrote to memory of 1496	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	30
PID 1772 wrote to memory of 1496	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	30
PID 1772 wrote to memory of 1496	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	30
PID 1772 wrote to memory of 1496	1772	0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe	30

C:\Users\Admin\AppData\Local\Temp\0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe
"C:\Users\Admin\AppData\Local\Temp\0baf968b2431209d904281476a75b04188751a3eb130231e6bf2cea552ef17d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 36
  2⤵
  - Program crash
  PID:1496

memory/932-54-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download
memory/932-55-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download
memory/932-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/932-61-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download
memory/932-62-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download
memory/932-63-0x0000000007080000-0x00000000070C0000-memory.dmp

Filesize
256KB

Download