72be2ed32f7731e3801d4cb4c55b4772270f66ddd9b67089ec40eb9d8ac02493

Analysis

max time kernel
136s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:18

Target

27d760cb536ee94e29ef39183e4bddd5.exe
Size

264KB
MD5

27d760cb536ee94e29ef39183e4bddd5
SHA1

5d9b35358bdd338473b830efbef44f287d712887
SHA256

72be2ed32f7731e3801d4cb4c55b4772270f66ddd9b67089ec40eb9d8ac02493
SHA512

0496c903209a98f2738fb48500d6b06fb7936c68090871dd045e7cdec5dc1132f1fecd4f72501e09a9e42ad3ca36152eadd2c019bbd7a08c21ef10ad71eb48fa
SSDEEP

6144:6J/Urq5zYDdoaEcHsFH3e0XPukO23Oc2Zp:xrVDdZj2H3xWkB3Ocs

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2072	27d760cb536ee94e29ef39183e4bddd5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\xinstall2094000.dll	27d760cb536ee94e29ef39183e4bddd5.exe
File created	C:\windows\xinstall2094000.dll	27d760cb536ee94e29ef39183e4bddd5.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	2072	WerFault.exe	88

Suspicious behavior: LoadsDriver 8 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

C:\Users\Admin\AppData\Local\Temp\27d760cb536ee94e29ef39183e4bddd5.exe
"C:\Users\Admin\AppData\Local\Temp\27d760cb536ee94e29ef39183e4bddd5.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 452
  2⤵
  - Program crash
  PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2072 -ip 2072
1⤵
PID:1876

C:\Windows\xinstall2094000.dll

Filesize
206KB

MD5
1b925db34ae471de21e899d97ea658f7

SHA1
5cf2a59cadb95d94763b7537b4b9236aef78eee1

SHA256
32a33ccc95a4d9f7f38276c84f7260aded38e91f3e57b7d8cd1c8cdbcc685ecc

SHA512
130e59b4ba96bbe26bc19e3b0b778348d6f8c7bef0df59af6918720b918758405bc5365ccc71f32a2bcfdd35005220de3f75265d8f4a9ad203cedb0c7d4ec230

Download Submit
memory/2072-4-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download