3adc37c2b59ec1d722cd9f1171ab01a4865637b60fd61f116734ad6f092c72f5

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 19:07

Target

3adc37c2b59ec1d722cd9f1171ab01a4865637b60fd61f116734ad6f092c72f5.exe
Size

172KB
MD5

9b0ea22741d34c7ab4dbddf775b68f95
SHA1

5bd9aec81a5de0ca2e993f88c82b590fc091c58b
SHA256

3adc37c2b59ec1d722cd9f1171ab01a4865637b60fd61f116734ad6f092c72f5
SHA512

95442afe89f61383fd3b24a2cf17368d9fdd5e352e54b3f6fdb1855ebfc94f42986d35fd5f01a7e6bf5e0ca56b5a5d6d443b661500f0d862493c21a5d21f7bea
SSDEEP

3072:uoUvg4fqjO00Yhxumzc6QIFqC067xd8xYCXE:uojV0YHzc6QIFqCNFd8X0

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4676	fwjctpb.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fwjctpb.exe	3adc37c2b59ec1d722cd9f1171ab01a4865637b60fd61f116734ad6f092c72f5.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	4676	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	fwjctpb.exe
4676	fwjctpb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	fwjctpb.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3420	4676	fwjctpb.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\3adc37c2b59ec1d722cd9f1171ab01a4865637b60fd61f116734ad6f092c72f5.exe
  "C:\Users\Admin\AppData\Local\Temp\3adc37c2b59ec1d722cd9f1171ab01a4865637b60fd61f116734ad6f092c72f5.exe"
  2⤵
  - Drops file in Program Files directory
  PID:768

C:\PROGRA~3\Mozilla\fwjctpb.exe
C:\PROGRA~3\Mozilla\fwjctpb.exe -qdcpmcc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 556
  2⤵
  - Program crash
  PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4676 -ip 4676
1⤵
PID:3660

C:\ProgramData\Mozilla\fwjctpb.exe

Filesize
172KB

MD5
3827303859d6bbd683206b7bb70a69f3

SHA1
03550406c7b6068dd2dca2eda453ec7850c9238e

SHA256
44668e63f5be689eaf6df2d3254e34857e10714fd604e334b9b74f0f11795b67

SHA512
a8155bd1ec8e35c7de121e1216d5952c83a376bd48c06c2517bcfd17a373a71c40d061a3502026d8f18738cb1b021ee5dbee387de4ee42a62606e42d39339c05

Download Submit
memory/768-0-0x0000000002280000-0x00000000022DF000-memory.dmp

Filesize
380KB

Download
memory/768-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/768-5-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3420-9-0x0000000002B00000-0x0000000002B1C000-memory.dmp

Filesize
112KB

Download
memory/4676-7-0x0000000001F40000-0x0000000001F9F000-memory.dmp

Filesize
380KB

Download
memory/4676-8-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4676-10-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download