c64c9483838c761d905d62fdb4302a294f89042f5f601fe1b14627c4cf54a0fd

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:12

Target

1875f660a5037e07c54705cd5ab25283.exe
Size

20KB
MD5

1875f660a5037e07c54705cd5ab25283
SHA1

668ef788997d266e32cc27ba71c1d0e9b1119871
SHA256

c64c9483838c761d905d62fdb4302a294f89042f5f601fe1b14627c4cf54a0fd
SHA512

5df4676e06ec01daf4ce455d27f101f28dab6c787f47dc819325569708c6df4b10f30d414cabf5e40f4b0972d8bc2ad076ef993272c863d24e3a482650a64cba
SSDEEP

384:xYRR1F4WDc4lLDcyGMBxvAshPs37EZ4FJ11jXM1Y7fBU4Em/QKCoc:6ZDcgv1Ps3YKFJ11jc4Bl7C

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4436 set thread context of 4984	4436	1875f660a5037e07c54705cd5ab25283.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
736	4984	WerFault.exe
2172	4436	WerFault.exe	14

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4436	1875f660a5037e07c54705cd5ab25283.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4984	4436	1875f660a5037e07c54705cd5ab25283.exe	28
PID 4436 wrote to memory of 4984	4436	1875f660a5037e07c54705cd5ab25283.exe	28
PID 4436 wrote to memory of 4984	4436	1875f660a5037e07c54705cd5ab25283.exe	28
PID 4436 wrote to memory of 4984	4436	1875f660a5037e07c54705cd5ab25283.exe	28
PID 4436 wrote to memory of 4984	4436	1875f660a5037e07c54705cd5ab25283.exe	28
PID 4436 wrote to memory of 4984	4436	1875f660a5037e07c54705cd5ab25283.exe	28
PID 4436 wrote to memory of 4984	4436	1875f660a5037e07c54705cd5ab25283.exe	28

C:\Users\Admin\AppData\Local\Temp\1875f660a5037e07c54705cd5ab25283.exe
"C:\Users\Admin\AppData\Local\Temp\1875f660a5037e07c54705cd5ab25283.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 276
  2⤵
  - Program crash
  PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4436 -ip 4436
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4984 -ip 4984
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 224
1⤵
- Program crash
PID:736

memory/4436-0-0x0000000014140000-0x0000000014149000-memory.dmp

Filesize
36KB

Download
memory/4984-1-0x0000000013140000-0x000000001324A000-memory.dmp

Filesize
1.0MB

Download