664fd170b1d07e372b3daa91aab78a8151d3f0b0361a2b3157b405314dd219a2

Resubmissions

20-04-2023 08:22

27-03-2023 09:38

max time kernel
81s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2023 08:22

Target

GetPass.exe
Size

178KB
MD5

2e17ac792a4ae32ff5c9d751ab3a77e3
SHA1

d18d952b24110b83abd17e042f9deee679de6a1a
SHA256

e9cffb4773da2d46282aeafc6680e7aed8ff8537040a2a27d3c1ee3e3229d88e
SHA512

30144f1ad0b0967f29dc4628ef50485fff201234041fa4aba8fc55521ca10aa3b16f391c5c7332267438235985d9e703b6155c59b1c34f06dbb56ae0072899d9
SSDEEP

3072:EnPhSvw5JB9goXOO8Ua7o+NbUmW8NUCABqJ+iS5xqlIJPZrn1c2x45Y/32kls5xi:EnPhtfBLOn7vNbUmnWqJt4xqlIld1XxJ

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral8/memory/2500-133-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral8/memory/2500-134-0x0000000000400000-0x00000000004A6000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	2500	WerFault.exe	86

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	GetPass.exe

C:\Users\Admin\AppData\Local\Temp\GetPass.exe
"C:\Users\Admin\AppData\Local\Temp\GetPass.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 340
  2⤵
  - Program crash
  PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2500 -ip 2500
1⤵
PID:404

memory/2500-133-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2500-134-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download