3deccacfb0a387c136e7cc11b7911ac722974691b4049bfefbae196bc1434055

Analysis

max time kernel
148s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:15

Target

6dbdba6bb0de308e700b205f31c0f4fa.exe
Size

174KB
MD5

6dbdba6bb0de308e700b205f31c0f4fa
SHA1

2e1544ed2d02bac610c8506521e20c629bffffa7
SHA256

3deccacfb0a387c136e7cc11b7911ac722974691b4049bfefbae196bc1434055
SHA512

792aaeb46de735db1d565f094409a3b84a9e7df1c351b238f68e965410d2a462e87877971393c2a7f13730c57119fed2489b5946fd9d26e1db4101c27e9a6e43
SSDEEP

3072:bjOeJoRFNWqQ1CWwONyNnpVkQVXSxFxPDsMnsPRlqpah:3yBjZkFx7sM0zoi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 4420	2348	6dbdba6bb0de308e700b205f31c0f4fa.exe	30

Program crash 1 IoCs

pid	pid_target	Process
3552	4420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	6dbdba6bb0de308e700b205f31c0f4fa.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4420	6dbdba6bb0de308e700b205f31c0f4fa.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4420	2348	6dbdba6bb0de308e700b205f31c0f4fa.exe	30
PID 2348 wrote to memory of 4420	2348	6dbdba6bb0de308e700b205f31c0f4fa.exe	30
PID 2348 wrote to memory of 4420	2348	6dbdba6bb0de308e700b205f31c0f4fa.exe	30
PID 2348 wrote to memory of 4420	2348	6dbdba6bb0de308e700b205f31c0f4fa.exe	30
PID 2348 wrote to memory of 4420	2348	6dbdba6bb0de308e700b205f31c0f4fa.exe	30
PID 2348 wrote to memory of 4420	2348	6dbdba6bb0de308e700b205f31c0f4fa.exe	30

C:\Users\Admin\AppData\Local\Temp\6dbdba6bb0de308e700b205f31c0f4fa.exe
"C:\Users\Admin\AppData\Local\Temp\6dbdba6bb0de308e700b205f31c0f4fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\6dbdba6bb0de308e700b205f31c0f4fa.exe
  C:\Users\Admin\AppData\Local\Temp\6dbdba6bb0de308e700b205f31c0f4fa.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4420 -ip 4420
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 12
1⤵
- Program crash
PID:3552

memory/2348-1-0x0000000000D10000-0x0000000000D20000-memory.dmp

Filesize
64KB

Download
memory/2348-2-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2348-0-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2348-5-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4420-3-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download