3c5e0085adfb6d60d77aa3b3f4a8cf2e3beb1139de69d1f921c6e1017da16a9f

Resubmissions

02-04-2024 18:02

02-04-2024 17:49

max time kernel
1790s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 18:02

Target

JIGUtility_V2.0.8.0_20230112/ASUSR_ParsingRecord/ASUSR_ParsingRecord/QtCore4.dll
Size

2.5MB
MD5

8bb8ab53f24b3f37ffc8d9818a96b711
SHA1

5fadc82e34210c23095b1a96f6b5c88ac109d391
SHA256

df2f1fef45edcc147c89a71898e1ae4be0274adee81a8c9d8848b5e8be6cbbab
SHA512

766a92861d234a7a186cf8cf2fbce9fa5678425e6953b9c9c49dad5bfea6ae81101dcebcabee9afa55fd2c8a7cbd369db750c966310c4486cf4ab706e9a87cd9
SSDEEP

49152:vNt3iB8mwK6LX/DE4G3Jsv6tWKFdu9CAT/LyvL/6mShMZtmjNUVrciV5P+7QVg0M:vn3iaw3Jsv6tWKFdu9CQ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4408	4196	WerFault.exe	93

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description	pid	Process
Token: SeManageVolumePrivilege	4636	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4624 wrote to memory of 4196	4624	rundll32.exe	93
PID 4624 wrote to memory of 4196	4624	rundll32.exe	93
PID 4624 wrote to memory of 4196	4624	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JIGUtility_V2.0.8.0_20230112\ASUSR_ParsingRecord\ASUSR_ParsingRecord\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JIGUtility_V2.0.8.0_20230112\ASUSR_ParsingRecord\ASUSR_ParsingRecord\QtCore4.dll,#1
  2⤵
  PID:4196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 648
    3⤵
    - Program crash
    PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4196 -ip 4196
1⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2012 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:772

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4636

memory/4636-0-0x000002705F2A0000-0x000002705F2B0000-memory.dmp

Filesize
64KB

Download
memory/4636-16-0x000002705F3A0000-0x000002705F3B0000-memory.dmp

Filesize
64KB

Download
memory/4636-32-0x0000027067710000-0x0000027067711000-memory.dmp

Filesize
4KB

Download
memory/4636-34-0x0000027067740000-0x0000027067741000-memory.dmp

Filesize
4KB

Download
memory/4636-35-0x0000027067740000-0x0000027067741000-memory.dmp

Filesize
4KB

Download
memory/4636-36-0x0000027067850000-0x0000027067851000-memory.dmp

Filesize
4KB

Download