55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2023 17:06

Target

55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe
Size

689KB
MD5

2a9e6fabb75eb23747dcd319e0aabbb3
SHA1

3eb348838b6ee3cb2500b37051d20f4ba393c6c0
SHA256

55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c
SHA512

6ef2294c1dd5764fff49fddd4aac2c6c139c1c9d898680496b56435cb99e219cf7fb9f2638a0a521526b6e02c40ea0a059ad61f72b2026c311a3d1826c7ad2da
SSDEEP

12288:zE6jD/arA24kGL2OdqJk3Ir3jLEbf+uRUacC2HT9+l0kHX9Hhm3HIAz8ENz:ztD/arAEG/tajQ+uapHTglr31hmYAYEN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 704 set thread context of 4712	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	4712	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe
704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe
4712	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe
4712	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 3284	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	93
PID 704 wrote to memory of 3284	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	93
PID 704 wrote to memory of 3284	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	93
PID 704 wrote to memory of 4712	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	94
PID 704 wrote to memory of 4712	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	94
PID 704 wrote to memory of 4712	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	94
PID 704 wrote to memory of 4712	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	94
PID 704 wrote to memory of 4712	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	94
PID 704 wrote to memory of 4712	704	55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe	94

C:\Users\Admin\AppData\Local\Temp\55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe
"C:\Users\Admin\AppData\Local\Temp\55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe
  "C:\Users\Admin\AppData\Local\Temp\55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe"
  2⤵
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe
  "C:\Users\Admin\AppData\Local\Temp\55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 184
    3⤵
    - Program crash
    PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4712 -ip 4712
1⤵
PID:3672

memory/704-6-0x00000000066F0000-0x0000000006708000-memory.dmp

Filesize
96KB

Download
memory/704-8-0x0000000002A60000-0x0000000002A6A000-memory.dmp

Filesize
40KB

Download
memory/704-2-0x0000000005560000-0x0000000005B04000-memory.dmp

Filesize
5.6MB

Download
memory/704-3-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/704-4-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/704-5-0x0000000005260000-0x000000000526A000-memory.dmp

Filesize
40KB

Download
memory/704-0-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/704-7-0x0000000005550000-0x0000000005556000-memory.dmp

Filesize
24KB

Download
memory/704-1-0x0000000000610000-0x00000000006C2000-memory.dmp

Filesize
712KB

Download
memory/704-9-0x00000000064B0000-0x000000000652E000-memory.dmp

Filesize
504KB

Download
memory/704-10-0x0000000009D10000-0x0000000009DAC000-memory.dmp

Filesize
624KB

Download
memory/704-13-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/4712-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4712-14-0x00000000016F0000-0x0000000001A3A000-memory.dmp

Filesize
3.3MB

Download
memory/4712-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download