90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 08:02

Target

90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74.exe
Size

754KB
MD5

fb4f85954ed41439eaa263a6d82cdb6b
SHA1

d263cd48d7f17166228e047f1cd4be187a5877e0
SHA256

90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74
SHA512

a376f9a38b6dc43039c9ce6e1f211fa4d5dc9ebad57e5161b1f76a711e0254aa9028efbf45b63d698352630129b5a5e3208c225b9f361594852d5ed7966d6f4c
SSDEEP

12288:pPMyQq8h0PGYcf1ntZf9DTCW6L2B96QTmodXdfdGoHRT3rX22PIoexqxIY4uUeLr:pPMyWh0PdcjDTCWVbTmodXdlGoxT3r/E

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2360-0-0x000000013F220000-0x000000013F39C000-memory.dmp	upx
behavioral1/memory/2360-10-0x000000013F220000-0x000000013F39C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2360	90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1628	2360	90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74.exe	28
PID 2360 wrote to memory of 1628	2360	90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74.exe	28
PID 2360 wrote to memory of 1628	2360	90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74.exe	28

C:\Users\Admin\AppData\Local\Temp\90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74.exe
"C:\Users\Admin\AppData\Local\Temp\90b15f45b5e5b8edfe9bc287f324d336d82ff0504e93af055071376b1af4fc74.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 820
  2⤵
  PID:1628

memory/2360-0-0x000000013F220000-0x000000013F39C000-memory.dmp

Filesize
1.5MB

Download
memory/2360-1-0x00000000005E0000-0x000000000061E000-memory.dmp

Filesize
248KB

Download
memory/2360-2-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Filesize
9.9MB

Download
memory/2360-3-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download
memory/2360-4-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download
memory/2360-5-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download
memory/2360-9-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download
memory/2360-10-0x000000013F220000-0x000000013F39C000-memory.dmp

Filesize
1.5MB

Download
memory/2360-11-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Filesize
9.9MB

Download
memory/2360-12-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download
memory/2360-13-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download
memory/2360-15-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download
memory/2360-16-0x0000000000350000-0x00000000003D0000-memory.dmp

Filesize
512KB

Download