f0264315eb031974aed214311d7e7d8697b4fae9417a9f8f2c5751946c6a873f

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 17:14

Target

d41176c3d3d2dd60b735619010411b5f.exe
Size

224KB
MD5

d41176c3d3d2dd60b735619010411b5f
SHA1

685fe3818b00ba7fb8fa6fbb475291d8b673d6ee
SHA256

f0264315eb031974aed214311d7e7d8697b4fae9417a9f8f2c5751946c6a873f
SHA512

865853a0bf43730f11a36596cbd83d79c6a0f87d1ba934ffc21135ec4befbf626e054f486e709b159fa15d461bc76c3910bb7cee3e3aec694bc53cd5dd7f4ae6
SSDEEP

6144:1mM3FgQCv8N1mlgEKlk88OMeIXfmUtZt8YHpElxyQoBe5+:1ftN1mlgM88O8uS78CIypB8+

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3632	example.exe

Loads dropped DLL 2 IoCs

pid	Process
624	iexplore.exe
624	iexplore.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3620	624	WerFault.exe	101

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\NR\example.exe	d41176c3d3d2dd60b735619010411b5f.exe
File opened for modification	C:\Windows\NR\example.exe	d41176c3d3d2dd60b735619010411b5f.exe
File created	C:\Windows\NR\example.dll	example.exe
File opened for modification	C:\Windows\NR\example.dll	example.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile	d41176c3d3d2dd60b735619010411b5f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell	d41176c3d3d2dd60b735619010411b5f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\open	d41176c3d3d2dd60b735619010411b5f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\open\command\ = "."	d41176c3d3d2dd60b735619010411b5f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\open\command	d41176c3d3d2dd60b735619010411b5f.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3632	3852	d41176c3d3d2dd60b735619010411b5f.exe	98
PID 3852 wrote to memory of 3632	3852	d41176c3d3d2dd60b735619010411b5f.exe	98
PID 3852 wrote to memory of 3632	3852	d41176c3d3d2dd60b735619010411b5f.exe	98
PID 3632 wrote to memory of 624	3632	example.exe	101
PID 3632 wrote to memory of 624	3632	example.exe	101
PID 3632 wrote to memory of 624	3632	example.exe	101
PID 3632 wrote to memory of 624	3632	example.exe	101

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 624 -ip 624
1⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4016

C:\Windows\NR\example.dll

Filesize
194KB

MD5
669c4fc20ea53e82f855b3f3dd3038b1

SHA1
8ddd6be22a9cc64c7dcbe9b3eae38fe4e1304bfe

SHA256
e02812d6889aa0f25b4db7e348c4335bd9575c525cb363fd3c89bf46893acf35

SHA512
7d1bc9ee250e6979eda5165be8af9fa50f4d49b1bf5c8b2df9d1c74b9ff73b7bf9bb84bb4f4659a112de6e00662d49489c8f26130e44417963c4162d4c9acc8d

Download Submit
C:\Windows\NR\example.exe

Filesize
224KB

MD5
d41176c3d3d2dd60b735619010411b5f

SHA1
685fe3818b00ba7fb8fa6fbb475291d8b673d6ee

SHA256
f0264315eb031974aed214311d7e7d8697b4fae9417a9f8f2c5751946c6a873f

SHA512
865853a0bf43730f11a36596cbd83d79c6a0f87d1ba934ffc21135ec4befbf626e054f486e709b159fa15d461bc76c3910bb7cee3e3aec694bc53cd5dd7f4ae6

Download Submit
memory/3632-11-0x0000000013140000-0x000000001317E000-memory.dmp

Filesize
248KB

Download
memory/3852-5-0x0000000013140000-0x000000001317E000-memory.dmp

Filesize
248KB

Download