fb90e44b3cee07603ac920b560d1d792346f8e66a3a85ddeda6df64ba25cb832

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:29

Target

0897ff53384810f4e68f01bac778bcd7.exe
Size

1.0MB
MD5

0897ff53384810f4e68f01bac778bcd7
SHA1

3e0e20cab5db93d615f1f753a75338440ccffbf6
SHA256

fb90e44b3cee07603ac920b560d1d792346f8e66a3a85ddeda6df64ba25cb832
SHA512

e4b0f107717421d78fb7cfa87a881ed1d3a5d458926dc1897b747b10177acb6ef89ee576da59c03225e4361fe7324ab0ad0f46dd265abb92a0c93a9ccd4962a4
SSDEEP

24576:9ht/BcMXmE5ZIFQL/Qcpi7UOOrqTlHCRifwzBbUY:9jB9WPFQLIdg1olVfwzBX

Score

6^/10

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0897ff53384810f4e68f01bac778bcd7.exe

description pid process

Token: SeDebugPrivilege 2864 0897ff53384810f4e68f01bac778bcd7.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	2864	0897ff53384810f4e68f01bac778bcd7.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0897ff53384810f4e68f01bac778bcd7.exe

description	pid	process	target process
PID 2864 wrote to memory of 2548	2864	0897ff53384810f4e68f01bac778bcd7.exe	WerFault.exe
PID 2864 wrote to memory of 2548	2864	0897ff53384810f4e68f01bac778bcd7.exe	WerFault.exe
PID 2864 wrote to memory of 2548	2864	0897ff53384810f4e68f01bac778bcd7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0897ff53384810f4e68f01bac778bcd7.exe
"C:\Users\Admin\AppData\Local\Temp\0897ff53384810f4e68f01bac778bcd7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2864 -s 1332
  2⤵
  PID:2548

memory/2864-0-0x00000000008A0000-0x00000000009B6000-memory.dmp

Filesize
1.1MB

Download
memory/2864-1-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

Filesize
9.9MB

Download
memory/2864-3-0x000000001B080000-0x000000001B100000-memory.dmp

Filesize
512KB

Download
memory/2864-2-0x00000000004F0000-0x00000000005AE000-memory.dmp

Filesize
760KB

Download
memory/2864-4-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

Filesize
9.9MB

Download
memory/2864-5-0x000000001B080000-0x000000001B100000-memory.dmp

Filesize
512KB

Download