7592428ef31a712ca8cb3b0deae050c54bd114c5b26f2816a9f009d3d0f9aa7d

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 04:50

Target

4fa15e284357982627d86b49381fe11b.exe
Size

65KB
MD5

4fa15e284357982627d86b49381fe11b
SHA1

8f54b5a8a0ff525d1ec2295af2e57e58466b0ce7
SHA256

7592428ef31a712ca8cb3b0deae050c54bd114c5b26f2816a9f009d3d0f9aa7d
SHA512

4564bd8e433b2ef187eb8ec31d31370f088522039e60d1d65b873efa0f37afd2baeefc1025f7a7a3fcef704f2209bf6f78417b711dd8f5ea28aefc43a5d64a14
SSDEEP

1536:/PEMIZc37LFind5QOXJKozjJAgagk1hBcUMV0d4GZWK:XGILFQPQOoWALfrMV0d4GZWK

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5116	mscfco.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscfco.exe	4fa15e284357982627d86b49381fe11b.exe
File opened for modification	C:\Windows\SysWOW64\mscfco.exe	4fa15e284357982627d86b49381fe11b.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
876	896	WerFault.exe	16
2288	5116	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	mscfco.exe
Token: SeDebugPrivilege	5116	mscfco.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 808	5116	mscfco.exe	91
PID 896 wrote to memory of 4264	896	4fa15e284357982627d86b49381fe11b.exe	33
PID 896 wrote to memory of 4264	896	4fa15e284357982627d86b49381fe11b.exe	33
PID 896 wrote to memory of 4264	896	4fa15e284357982627d86b49381fe11b.exe	33

C:\Users\Admin\AppData\Local\Temp\4fa15e284357982627d86b49381fe11b.exe
"C:\Users\Admin\AppData\Local\Temp\4fa15e284357982627d86b49381fe11b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 384
  2⤵
  - Program crash
  PID:876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Deleteme.bat
  2⤵
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 896 -ip 896
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 388
1⤵
- Program crash
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5116 -ip 5116
1⤵
PID:228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:808

memory/896-7-0x0000000029820000-0x0000000029836000-memory.dmp

Filesize
88KB

Download
memory/5116-6-0x0000000029820000-0x0000000029836000-memory.dmp

Filesize
88KB

Download