94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 01:40

Target

94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe
Size

1.4MB
MD5

78626f662b2669f5d5a19820b113d13b
SHA1

b4ab6d5cc05a5f951d5dea915abac8c85d99901f
SHA256

94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f
SHA512

a0c0d84d204fa75bc0f05d676c45330bafa4fd6baf1c3b9b5d511a813cd1d0059c58949b581e956ac436ac7b0d12130d63c5d86130db1e34f73bc5d1b73316ca
SSDEEP

24576:uF/6FjEIvAZwEG2FvGEOFsrwmPMo3lx9NcMI/5dXz1P:Y/6REAqwuOnmV3lRQB5z

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	1992	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1992	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe
1992	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2636	1992	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe	28
PID 1992 wrote to memory of 2636	1992	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe	28
PID 1992 wrote to memory of 2636	1992	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe	28
PID 1992 wrote to memory of 2636	1992	94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe	28

C:\Users\Admin\AppData\Local\Temp\94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe
"C:\Users\Admin\AppData\Local\Temp\94d3f0945f2c96872e372a1821728db56bfcef7c1f16f7ca43fe8e751d60da9f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 1208
  2⤵
  - Program crash
  PID:2636

memory/1992-0-0x0000000000EB0000-0x000000000101C000-memory.dmp

Filesize
1.4MB

Download
memory/1992-1-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/1992-2-0x0000000000A80000-0x0000000000AC0000-memory.dmp

Filesize
256KB

Download
memory/1992-3-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/1992-4-0x0000000000A80000-0x0000000000AC0000-memory.dmp

Filesize
256KB

Download