a62467a00b7447610aa2b6d2f0b1e82c56086d9ee0411a96b4d49889ae03b2ac

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2023, 23:50

Target

057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
Size

646KB
MD5

d569c4642597d5b883b3ae598bcc19b3
SHA1

7b8fa0006d9a7dc803eb1dd5c2ab2b4314942001
SHA256

057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910
SHA512

8dfb4d6280de31e2183a19ed790626485004d66a2b85d2dc3312b06a05cd47fe82add4e64d417709a38ea28ee7c3f0275af90fd1534857b5be643ea4d709ebe6
SSDEEP

12288:3uP4KRi4cu659UrnsLoaEYkTOKKvnZzxoYYxj9eKjRKvYqg:iJRik65iwuYZ1oYgi1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4572 set thread context of 4320	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	4320	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4324	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	93
PID 4572 wrote to memory of 4324	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	93
PID 4572 wrote to memory of 4324	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	93
PID 4572 wrote to memory of 3648	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	95
PID 4572 wrote to memory of 3648	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	95
PID 4572 wrote to memory of 3648	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	95
PID 4572 wrote to memory of 4320	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	94
PID 4572 wrote to memory of 4320	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	94
PID 4572 wrote to memory of 4320	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	94
PID 4572 wrote to memory of 4320	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	94
PID 4572 wrote to memory of 4320	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	94
PID 4572 wrote to memory of 4320	4572	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	94

C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
"C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
  "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
  "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 184
    3⤵
    - Program crash
    PID:4412
- C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
  "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
  2⤵
  PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4320 -ip 4320
1⤵
PID:1280

memory/4320-10-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4320-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4320-14-0x00000000013A0000-0x00000000016EA000-memory.dmp

Filesize
3.3MB

Download
memory/4572-4-0x00000000031C0000-0x00000000031D0000-memory.dmp

Filesize
64KB

Download
memory/4572-0-0x00000000749A0000-0x0000000075150000-memory.dmp

Filesize
7.7MB

Download
memory/4572-5-0x00000000056B0000-0x00000000056BA000-memory.dmp

Filesize
40KB

Download
memory/4572-6-0x0000000005930000-0x0000000005946000-memory.dmp

Filesize
88KB

Download
memory/4572-7-0x0000000005940000-0x000000000594A000-memory.dmp

Filesize
40KB

Download
memory/4572-8-0x0000000006ED0000-0x0000000006F4C000-memory.dmp

Filesize
496KB

Download
memory/4572-9-0x0000000009510000-0x00000000095AC000-memory.dmp

Filesize
624KB

Download
memory/4572-11-0x00000000749A0000-0x0000000075150000-memory.dmp

Filesize
7.7MB

Download
memory/4572-12-0x00000000031C0000-0x00000000031D0000-memory.dmp

Filesize
64KB

Download
memory/4572-3-0x00000000056C0000-0x0000000005752000-memory.dmp

Filesize
584KB

Download
memory/4572-15-0x00000000749A0000-0x0000000075150000-memory.dmp

Filesize
7.7MB

Download
memory/4572-2-0x0000000005D50000-0x00000000062F4000-memory.dmp

Filesize
5.6MB

Download
memory/4572-1-0x0000000000C00000-0x0000000000CA8000-memory.dmp

Filesize
672KB

Download