464e8d4a7003d8a0b1fa1ac3329507374f8e99d6b0fa9948ae3244b7c665e12c

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 01:52

Target

c228fe269d0c65502364e0f52edee4f6.exe
Size

329KB
MD5

c228fe269d0c65502364e0f52edee4f6
SHA1

134c16febaceaf290624604eca5f2541af0827b6
SHA256

464e8d4a7003d8a0b1fa1ac3329507374f8e99d6b0fa9948ae3244b7c665e12c
SHA512

080b5a5930569b5ffe7873eeba16191d58a4daf3a4fdf169a2f2126f9f8fad15182138c40ef2c3a295144bfa5defd05785adcae6d9bed35de4e3e8f3cd2546ef
SSDEEP

6144:VO+W8I3UJWiC3Oq4csVJemXikfcYv56Irrs62Bnt2q0sOyE:VJW8I3UJC3OHzXbkU5d2BnC

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/2128-6-0x0000000000430000-0x000000000043A000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2592 2128 WerFault.exe c228fe269d0c65502364e0f52edee4f6.exe

pid	pid_target	process	target process
2592	2128	WerFault.exe	c228fe269d0c65502364e0f52edee4f6.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

c228fe269d0c65502364e0f52edee4f6.exe

description	pid	process
Token: SeDebugPrivilege	2128	c228fe269d0c65502364e0f52edee4f6.exe
Token: 33	2128	c228fe269d0c65502364e0f52edee4f6.exe
Token: SeIncBasePriorityPrivilege	2128	c228fe269d0c65502364e0f52edee4f6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c228fe269d0c65502364e0f52edee4f6.exe

description	pid	process	target process
PID 2128 wrote to memory of 2592	2128	c228fe269d0c65502364e0f52edee4f6.exe	WerFault.exe
PID 2128 wrote to memory of 2592	2128	c228fe269d0c65502364e0f52edee4f6.exe	WerFault.exe
PID 2128 wrote to memory of 2592	2128	c228fe269d0c65502364e0f52edee4f6.exe	WerFault.exe
PID 2128 wrote to memory of 2592	2128	c228fe269d0c65502364e0f52edee4f6.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 956
2⤵
- Program crash
PID:2592

memory/2128-0-0x0000000000260000-0x00000000002B8000-memory.dmp

Filesize
352KB

Download
memory/2128-1-0x0000000073E10000-0x00000000744FE000-memory.dmp

Filesize
6.9MB

Download
memory/2128-2-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/2128-3-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/2128-4-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/2128-5-0x00000000002E0000-0x00000000002EE000-memory.dmp

Filesize
56KB

Download
memory/2128-6-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/2128-7-0x0000000073E10000-0x00000000744FE000-memory.dmp

Filesize
6.9MB

Download
memory/2128-8-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download