846794ab91f137ea04c1c530069c9ac992ec43dfbfcafc3317773225a19a0689

Analysis

max time kernel
1607s
max time network
1610s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-05-2023 23:54

Target

Olympus.exe
Size

1.6MB
MD5

f0be4da3b32d61513371ecf570719885
SHA1

9d19d021c39be9ec83c15877a1076723fe41a257
SHA256

846794ab91f137ea04c1c530069c9ac992ec43dfbfcafc3317773225a19a0689
SHA512

1b7f5b4a5268ad7ec11bdf426c1ea47fe37d4a2563cf840dc31f9c1284065223c1f927c349b7275c914cb1814226602fa4897132e9c5ed92bdc56beef9a66e17
SSDEEP

24576:W7vdzEDnjH0WMqO/om295zBAVz70yN5FsBcGiYt70M:MGX0aO5xNoBcGzo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1696	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	Olympus.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1788	1696	Olympus.exe	27
PID 1696 wrote to memory of 1788	1696	Olympus.exe	27
PID 1696 wrote to memory of 1788	1696	Olympus.exe	27

C:\Users\Admin\AppData\Local\Temp\Olympus.exe
"C:\Users\Admin\AppData\Local\Temp\Olympus.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1696 -s 1624
  2⤵
  - Program crash
  PID:1788

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar71ED.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/1696-54-0x0000000001100000-0x0000000001294000-memory.dmp

Filesize
1.6MB

Download
memory/1696-55-0x0000000000C40000-0x0000000000CC0000-memory.dmp

Filesize
512KB

Download