863bc4b2312d434765e5f6139a78aef5d1129f7b5993743dd3ebe575b717a23a

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:28

Target

599ca8f5851b74665fe15d98671d1158.exe
Size

156KB
MD5

599ca8f5851b74665fe15d98671d1158
SHA1

30ceb0fb944446500e183c37d8f856c8cfa7a4ae
SHA256

863bc4b2312d434765e5f6139a78aef5d1129f7b5993743dd3ebe575b717a23a
SHA512

914922a3b279cd0190e591f8e31b8b8e8c7a5d8c4ca41c95de753dd147525109d2617cec6b32b4eeb06adb9cdb5c07c7266937223a82d2893001140a46d99a85
SSDEEP

3072:JYtZ4CBsZb283TRqEba572VGQfjAdQPY+QF4YO+Lh:Jlm6TRqEba57DQfMdQAT5X

Score

8^/10

evasion

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	599ca8f5851b74665fe15d98671d1158.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34

Program crash 1 IoCs

pid	pid_target	Process
2380	1692	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	599ca8f5851b74665fe15d98671d1158.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1692	2736	599ca8f5851b74665fe15d98671d1158.exe	34
PID 2736 wrote to memory of 1908	2736	599ca8f5851b74665fe15d98671d1158.exe	29
PID 2736 wrote to memory of 1908	2736	599ca8f5851b74665fe15d98671d1158.exe	29
PID 2736 wrote to memory of 1908	2736	599ca8f5851b74665fe15d98671d1158.exe	29
PID 2736 wrote to memory of 1908	2736	599ca8f5851b74665fe15d98671d1158.exe	29
PID 1692 wrote to memory of 2380	1692	599ca8f5851b74665fe15d98671d1158.exe	33
PID 1692 wrote to memory of 2380	1692	599ca8f5851b74665fe15d98671d1158.exe	33
PID 1692 wrote to memory of 2380	1692	599ca8f5851b74665fe15d98671d1158.exe	33
PID 1692 wrote to memory of 2380	1692	599ca8f5851b74665fe15d98671d1158.exe	33
PID 1908 wrote to memory of 2292	1908	net.exe	32
PID 1908 wrote to memory of 2292	1908	net.exe	32
PID 1908 wrote to memory of 2292	1908	net.exe	32
PID 1908 wrote to memory of 2292	1908	net.exe	32

C:\Users\Admin\AppData\Local\Temp\599ca8f5851b74665fe15d98671d1158.exe
"C:\Users\Admin\AppData\Local\Temp\599ca8f5851b74665fe15d98671d1158.exe"
1⤵
- Disables RegEdit via registry modification
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\net.exe
  net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:2292
- C:\Users\Admin\AppData\Local\Temp\599ca8f5851b74665fe15d98671d1158.exe
  C:\Users\Admin\AppData\Local\Temp\599ca8f5851b74665fe15d98671d1158.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 128
1⤵
- Program crash
PID:2380

memory/1692-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1692-7-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1692-6-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1692-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download