104abce62386d513f5fee5de90a86aae430c00bbfc6cd05f4cf183b058a4cdb5

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 15:27

Target

196f562ae3cebed851f73043975d99dd.exe
Size

339KB
MD5

196f562ae3cebed851f73043975d99dd
SHA1

0808080c6d5ffddd265a93e3e4a562e80114ade8
SHA256

104abce62386d513f5fee5de90a86aae430c00bbfc6cd05f4cf183b058a4cdb5
SHA512

5268f09614b0653be57745afbe2fabf08f8e74d36b53ddf50b04cec6ea264d884e47e1fcfc37c3e4781c86166dbf6b6f7876cfbdac3472c10ad8ed92ec38536a
SSDEEP

6144:5rguHQQbURQH1xAipzE80jWS1YKydW89T9Zz+9A6W5g2NYY:5rguH/URQVxAipzI2i8t9ZyA6W5gW

Score

7^/10

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2888 1032 WerFault.exe 196f562ae3cebed851f73043975d99dd.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

2168 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2168 Powershell.exe

pid	pid_target	process	target process
2888	1032	WerFault.exe	196f562ae3cebed851f73043975d99dd.exe

pid	process
2168	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	2168	Powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

196f562ae3cebed851f73043975d99dd.exe

description	pid	process	target process
PID 1032 wrote to memory of 2168	1032	196f562ae3cebed851f73043975d99dd.exe	Powershell.exe
PID 1032 wrote to memory of 2168	1032	196f562ae3cebed851f73043975d99dd.exe	Powershell.exe
PID 1032 wrote to memory of 2168	1032	196f562ae3cebed851f73043975d99dd.exe	Powershell.exe
PID 1032 wrote to memory of 2168	1032	196f562ae3cebed851f73043975d99dd.exe	Powershell.exe
PID 1032 wrote to memory of 2780	1032	196f562ae3cebed851f73043975d99dd.exe	196f562ae3cebed851f73043975d99dd.exe
PID 1032 wrote to memory of 2780	1032	196f562ae3cebed851f73043975d99dd.exe	196f562ae3cebed851f73043975d99dd.exe
PID 1032 wrote to memory of 2780	1032	196f562ae3cebed851f73043975d99dd.exe	196f562ae3cebed851f73043975d99dd.exe
PID 1032 wrote to memory of 2780	1032	196f562ae3cebed851f73043975d99dd.exe	196f562ae3cebed851f73043975d99dd.exe
PID 1032 wrote to memory of 2888	1032	196f562ae3cebed851f73043975d99dd.exe	WerFault.exe
PID 1032 wrote to memory of 2888	1032	196f562ae3cebed851f73043975d99dd.exe	WerFault.exe
PID 1032 wrote to memory of 2888	1032	196f562ae3cebed851f73043975d99dd.exe	WerFault.exe
PID 1032 wrote to memory of 2888	1032	196f562ae3cebed851f73043975d99dd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\196f562ae3cebed851f73043975d99dd.exe
"C:\Users\Admin\AppData\Local\Temp\196f562ae3cebed851f73043975d99dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Users\Admin\AppData\Local\Temp\196f562ae3cebed851f73043975d99dd.exe
"C:\Users\Admin\AppData\Local\Temp\196f562ae3cebed851f73043975d99dd.exe"
2⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 624
2⤵
- Program crash
PID:2888

memory/1032-0-0x0000000000190000-0x00000000001EA000-memory.dmp

Filesize
360KB

Download
memory/1032-1-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/1032-2-0x0000000000710000-0x000000000074E000-memory.dmp

Filesize
248KB

Download
memory/1032-3-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/1032-8-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/1032-12-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2168-6-0x00000000706A0000-0x0000000070C4B000-memory.dmp

Filesize
5.7MB

Download
memory/2168-7-0x00000000706A0000-0x0000000070C4B000-memory.dmp

Filesize
5.7MB

Download
memory/2168-9-0x0000000002640000-0x0000000002680000-memory.dmp

Filesize
256KB

Download
memory/2168-11-0x00000000706A0000-0x0000000070C4B000-memory.dmp

Filesize
5.7MB

Download