6e80ae97afbf03d607739d56573ca1bfed33928a92e54cf25b809c1eb4be41f4

Analysis

max time kernel
150s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 00:28

Target

3e41b66bf25239d4a6fd4988ed815e9a.exe
Size

49KB
MD5

3e41b66bf25239d4a6fd4988ed815e9a
SHA1

e3b0cdcbf16d8fb7e9ac9dd7c1a62a2cffada4e0
SHA256

6e80ae97afbf03d607739d56573ca1bfed33928a92e54cf25b809c1eb4be41f4
SHA512

4addc4f84c20951ac4e7a374a1e877e7501a96a66202187b70d430053595f5b2098118b26db7c72bc5c522c7e0841292519842e97b841024409544bb67905a85
SSDEEP

768:xhO6ehxebu/cMnvhjj4fisQi/h7Te4+ykYVo:xUnxea0GvRcjN7Te4hkAo

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2500	tmp.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2456	2500	WerFault.exe	97
4668	2500	WerFault.exe	97

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	3e41b66bf25239d4a6fd4988ed815e9a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 2500	3856	3e41b66bf25239d4a6fd4988ed815e9a.exe	97
PID 3856 wrote to memory of 2500	3856	3e41b66bf25239d4a6fd4988ed815e9a.exe	97
PID 3856 wrote to memory of 2500	3856	3e41b66bf25239d4a6fd4988ed815e9a.exe	97
PID 2500 wrote to memory of 2456	2500	tmp.exe	105
PID 2500 wrote to memory of 2456	2500	tmp.exe	105
PID 2500 wrote to memory of 2456	2500	tmp.exe	105

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2500 -ip 2500
1⤵
PID:3252

C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
8KB

MD5
10cf617044b51c96a577b733f5255c46

SHA1
3607f3af2dd114746b632df8716c8606789fb35c

SHA256
e80d131b4a965bb0adb7e7a33bceb00865c18be0a31bb9e1c24ae8d9e90f64b0

SHA512
4c2353723c925e4ce35e34c8186cea60699d807bc1ac5a880604c9847025b27c164bc963c947c62d8e7ce3827de4779035f913fdee64dd3fa6be197c9847445b

Download Submit
memory/2500-18-0x0000000000400000-0x0000000000402200-memory.dmp

Filesize
8KB

Download
memory/3856-6-0x00007FF977510000-0x00007FF977EB1000-memory.dmp

Filesize
9.6MB

Download
memory/3856-3-0x000000001BCB0000-0x000000001BD56000-memory.dmp

Filesize
664KB

Download
memory/3856-4-0x000000001C230000-0x000000001C6FE000-memory.dmp

Filesize
4.8MB

Download
memory/3856-5-0x000000001C860000-0x000000001C8FC000-memory.dmp

Filesize
624KB

Download
memory/3856-0-0x00007FF977510000-0x00007FF977EB1000-memory.dmp

Filesize
9.6MB

Download
memory/3856-7-0x00007FF977510000-0x00007FF977EB1000-memory.dmp

Filesize
9.6MB

Download
memory/3856-8-0x000000001BC90000-0x000000001BC98000-memory.dmp

Filesize
32KB

Download
memory/3856-9-0x000000001C9C0000-0x000000001CA0C000-memory.dmp

Filesize
304KB

Download
memory/3856-2-0x00000000014E0000-0x00000000014F0000-memory.dmp

Filesize
64KB

Download
memory/3856-1-0x00007FF977510000-0x00007FF977EB1000-memory.dmp

Filesize
9.6MB

Download
memory/3856-24-0x00007FF977510000-0x00007FF977EB1000-memory.dmp

Filesize
9.6MB

Download