Analysis
-
max time kernel
139s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2024 05:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c4bda149d2de628286ae87ca424dd54.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c4bda149d2de628286ae87ca424dd54.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
5c4bda149d2de628286ae87ca424dd54.exe
-
Size
3.4MB
-
MD5
5c4bda149d2de628286ae87ca424dd54
-
SHA1
50476880a68a876ef49022a3316f95e647412156
-
SHA256
87940feda6607f7660227942f65fe3c43424b6eb1e2f03476cea06823cbbd1aa
-
SHA512
c8209f0464e64cabc3c21da4a2a4d22a83eb7bd6cdea47fde8180749e9e30b60d945be4549ba5dd24a386d2792fb279ccd93d905be24b8e4f7df53972a22573f
-
SSDEEP
98304:lZDSTWBhqrajhQ2F8upucqIfFc/8PKyy7rHu6n:LDYyhqmjyRcquFc/TVq6n
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3792 5c4bda149d2de628286ae87ca424dd54.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2768 3792 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe 3792 5c4bda149d2de628286ae87ca424dd54.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3792 5c4bda149d2de628286ae87ca424dd54.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c4bda149d2de628286ae87ca424dd54.exe"C:\Users\Admin\AppData\Local\Temp\5c4bda149d2de628286ae87ca424dd54.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 17522⤵
- Program crash
PID:2768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3792 -ip 37921⤵PID:2368