Analysis
-
max time kernel
162s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13-10-2023 13:16
General
-
Target
f885bb34a31ef0dbc674686bf9606f3f9a338f1302f14f884423f0da04f1009d.exe
-
Size
10.1MB
-
MD5
930bc14baf162266648ee4369f507101
-
SHA1
27f61b9c7588d364758bcab6c952cd2be6ae650b
-
SHA256
f885bb34a31ef0dbc674686bf9606f3f9a338f1302f14f884423f0da04f1009d
-
SHA512
ba5653cd8babb2333d74424ffea03cf2c248e7f76ef90b92c4bbe5e9ae49199b78032d93a0926b95ae8b7d39cbc1f07e96c651a1fc587d7be0a2931268343ce5
-
SSDEEP
196608:4YcJV0uG4oVINjOPDv5KqNwn1TuuKGi/zJyAzo:UEdINCPDhKqNMKzUP
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Program crash 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f885bb34a31ef0dbc674686bf9606f3f9a338f1302f14f884423f0da04f1009d.exe"C:\Users\Admin\AppData\Local\Temp\f885bb34a31ef0dbc674686bf9606f3f9a338f1302f14f884423f0da04f1009d.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 5602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 5642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1376 -ip 13761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1376 -ip 13761⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.1MB
-
Filesize
10.1MB