734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
1788s
max time network
1803s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 21:52

Sharing

Target

eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Security Defender 2015/[email protected]
Size

1.2MB
MD5

d5e5853f5a2a5a7413f26c625c0e240b
SHA1

0ced68483e7f3742a963f2507937bb7089de3ffe
SHA256

415dd13c421a27ed96bf81579b112fbac05862405e9964e24ec8e9d4611d25f3
SHA512

49ea9ab92ce5832e702fac6f56a7f7168f60d8271419460ed27970c4a0400e996c2ea097636fc145e355c4df5cfbf200b7bf3c691133f72e4cad228f570b91e4
SSDEEP

12288:QH1eYXlVeneL/AuCeGhqzjheKTnHdQSR9wlPlVlbzl+lwlElPS3PomNX:QVZVeneLYcmiN7Q6Md3dMyuI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 2620 WerFault.exe [email protected]
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 1648 svchost.exe

pid	pid_target	process	target process
1916	2620	WerFault.exe	[email protected]

description	pid	process
Token: SeManageVolumePrivilege	1648	svchost.exe

C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]
"C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]"
1⤵
PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 480
  2⤵
  - Program crash
  PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2620 -ip 2620
1⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=3016,i,1323102786462900035,7687994236215859601,262144 --variations-seed-version /prefetch:8
1⤵
PID:1620

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=3016,i,1323102786462900035,7687994236215859601,262144 --variations-seed-version /prefetch:8
1⤵
PID:2704

memory/1648-1-0x0000015DA2F40000-0x0000015DA2F50000-memory.dmp

Filesize
64KB

Download
memory/1648-17-0x0000015DA3040000-0x0000015DA3050000-memory.dmp

Filesize
64KB

Download
memory/1648-33-0x0000015DAB330000-0x0000015DAB331000-memory.dmp

Filesize
4KB

Download
memory/1648-35-0x0000015DAB360000-0x0000015DAB361000-memory.dmp

Filesize
4KB

Download
memory/1648-36-0x0000015DAB360000-0x0000015DAB361000-memory.dmp

Filesize
4KB

Download
memory/1648-37-0x0000015DAB470000-0x0000015DAB471000-memory.dmp

Filesize
4KB

Download
memory/2620-0-0x0000000000770000-0x00000000008AB000-memory.dmp

Filesize
1.2MB

Download