79d352413ec91e3c74925718fd3a7e8d6f234d62a2ceffb6a1e7c5b257ec48e9

Analysis

max time kernel
92s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:03

Target
$_4_/ILDownloadManager.exe
Size 2.2MB
Sample240224-vkn7eaha52
SHA256 c76d28df4462548cc72d031988c3d6462321dbde6822faadf4bdcf46de47c298
MD5 a5e7420e0faa985a79453060cab03908
SHA1 0f0399cd501ccc81daf176390b7403a3f0436c04
SHA512 76bfd4d233920e22a16f2bfbe58bbb97705bf72270b4629428eae0917dbdefd36eaf0192e098b8ff7f8abf0a0e323742730f176c60f9024b1ac81effabb879ee
SSDEEP 24576:LSmWS5R/Dp8hrcuK9feMPl2drPkrIrFxrilynwdX0cjfeKTsydYQ+z:+mWSTV85cuKfVPl2Vmosywl9TsydYQ+z
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1584	2388	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\$_4_\ILDownloadManager.exe
"C:\Users\Admin\AppData\Local\Temp\$_4_\ILDownloadManager.exe"
1⤵
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 1400
  2⤵
  - Program crash
  PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2388 -ip 2388
1⤵
PID:696

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact