eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 05:42

Target

eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe
Size

422KB
MD5

baa7d232d3b9b73538e925b4fa524610
SHA1

ad4ac32df3c9f3f6fe82d171123c2c03c12cb475
SHA256

eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc
SHA512

39053e5c0772d731dc31bab86830df2e3a6b0e099747ec407f587357d9914e738c00e5682f243549105187cda8fc7c44679548e75f50cb8ce39ff2960ca64929
SSDEEP

6144:MUagfY5/mIr3CE/87qLpFAOcu8DUXCYyvumtFJ2o41AW3UFWW6O:MxgfQOIT9XK9DWCY2jtBKkWW6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2812	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2012	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83
PID 2812 wrote to memory of 3064	2812	eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe	83

C:\Users\Admin\AppData\Local\Temp\eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe
"C:\Users\Admin\AppData\Local\Temp\eecd9c24809a27a847d2f1f747cf99228bc764a5b50fad5852dd6cdf68b187dc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 404
  2⤵
  - Program crash
  PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2812 -ip 2812
1⤵
PID:740

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012

memory/2012-5-0x0000020291780000-0x0000020291790000-memory.dmp

Filesize
64KB

Download
memory/2012-21-0x0000020291880000-0x0000020291890000-memory.dmp

Filesize
64KB

Download
memory/2012-37-0x0000020299BF0000-0x0000020299BF1000-memory.dmp

Filesize
4KB

Download
memory/2012-39-0x0000020299C20000-0x0000020299C21000-memory.dmp

Filesize
4KB

Download
memory/2012-40-0x0000020299C20000-0x0000020299C21000-memory.dmp

Filesize
4KB

Download
memory/2012-41-0x0000020299D30000-0x0000020299D31000-memory.dmp

Filesize
4KB

Download
memory/3064-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download