95a3ceba14c7721bf78ce38134e063cc42cd2ab899918b0b2ac17eb6a1defa58

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 08:44

Target

SKIDDIN WOLF.exe
Size

16KB
MD5

180f616198ec516eb8d601cfa11f16e5
SHA1

4997cbeb8d7f9c753b9c3456795d8af084691d82
SHA256

03ef8a24f331ffffd191a88c6636305836c2d98097090516bd8617c63be00b55
SHA512

f65290c40a71c0c0599d1da91e226d047c1275a7089f52df78021211a7a15a96258e02b103ab793731dbdb557859c4e73b984792c9704fd13d931f4235d09f2e
SSDEEP

384:l3hlLO4bsqcssvTPReUPSkPgBPGqIpbAeADMXPIvhRkONoc5tu/sxi3hFW:l3fLRbbHEPReUPSkPgBPGTlAeADMXPI/

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\IME\regedit_change.bat	SKIDDIN WOLF.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	1740	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	SKIDDIN WOLF.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2248	1740	SKIDDIN WOLF.exe	29
PID 1740 wrote to memory of 2248	1740	SKIDDIN WOLF.exe	29
PID 1740 wrote to memory of 2248	1740	SKIDDIN WOLF.exe	29
PID 1740 wrote to memory of 2248	1740	SKIDDIN WOLF.exe	29

C:\Users\Admin\AppData\Local\Temp\SKIDDIN WOLF.exe
"C:\Users\Admin\AppData\Local\Temp\SKIDDIN WOLF.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1092
  2⤵
  - Program crash
  PID:2248

memory/1740-0-0x0000000000BF0000-0x0000000000BFA000-memory.dmp

Filesize
40KB

Download
memory/1740-1-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1740-2-0x0000000004E50000-0x0000000004E90000-memory.dmp

Filesize
256KB

Download
memory/1740-3-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download