4bef625f1bb5de9c737f83332757bc60ac5351947637a4937ffdbf78c9d76731

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 21:17

Target

b07262fdce21a9e9ddcbf8881d6f70d2.exe
Size

947KB
MD5

b07262fdce21a9e9ddcbf8881d6f70d2
SHA1

8bd4b75838929f265e8ab9d190c0de75d61e7f7d
SHA256

4bef625f1bb5de9c737f83332757bc60ac5351947637a4937ffdbf78c9d76731
SHA512

2629a365633b2fd9359f843bdec75ac7890006ae3f5b5c9e177c67ee00b909520a8abce210e96292efae9e76149656c29520690d7370d8034a4abc25ed4efda5
SSDEEP

12288:hpHQIvI0ggnITMF8xnun44kMDPajPMX4qF46sQg0QOGGTO0NoLftS51ejq9Cs6Qy:4IQXOeu4lOajPMoqFfkBmNg2et

Score

6^/10

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b07262fdce21a9e9ddcbf8881d6f70d2.exe

description pid process

Token: SeDebugPrivilege 2876 b07262fdce21a9e9ddcbf8881d6f70d2.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	2876	b07262fdce21a9e9ddcbf8881d6f70d2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b07262fdce21a9e9ddcbf8881d6f70d2.exe

description	pid	process	target process
PID 2876 wrote to memory of 2616	2876	b07262fdce21a9e9ddcbf8881d6f70d2.exe	WerFault.exe
PID 2876 wrote to memory of 2616	2876	b07262fdce21a9e9ddcbf8881d6f70d2.exe	WerFault.exe
PID 2876 wrote to memory of 2616	2876	b07262fdce21a9e9ddcbf8881d6f70d2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b07262fdce21a9e9ddcbf8881d6f70d2.exe
"C:\Users\Admin\AppData\Local\Temp\b07262fdce21a9e9ddcbf8881d6f70d2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 1232
  2⤵
  PID:2616

memory/2876-0-0x00000000003B0000-0x00000000004A4000-memory.dmp

Filesize
976KB

Download
memory/2876-1-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2876-2-0x000000001AD40000-0x000000001ADFE000-memory.dmp

Filesize
760KB

Download
memory/2876-3-0x000000001AEB0000-0x000000001AF30000-memory.dmp

Filesize
512KB

Download
memory/2876-4-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download