095a10fc0b992d28fd110516164eb608316a7d2bded28a2e0bd7aa66e895197c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 05:50

Target

softcore-shd-lavacrypt.exe
Size

408KB
MD5

f1de359b4cb3e98d01e03f7f4aff75d7
SHA1

ff190e4a989695c64f95495c0347498ec11eabd7
SHA256

095a10fc0b992d28fd110516164eb608316a7d2bded28a2e0bd7aa66e895197c
SHA512

21fe1331649696cf61fcae8054b7660803e73881302d975a0767422d7af3426bd559de17add4a00eaeaa43500c9a5b87a0012afeee8a80b273e23e1ad7315400
SSDEEP

12288:8Jxyctbiy/9SgCf7iSdo1pkQLBB55De61:8Ty9y/4gCf7Qp5BBbq8

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	softcore-shd-lavacrypt.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2848	2912	softcore-shd-lavacrypt.exe	29
PID 2912 wrote to memory of 2848	2912	softcore-shd-lavacrypt.exe	29
PID 2912 wrote to memory of 2848	2912	softcore-shd-lavacrypt.exe	29

C:\Users\Admin\AppData\Local\Temp\softcore-shd-lavacrypt.exe
"C:\Users\Admin\AppData\Local\Temp\softcore-shd-lavacrypt.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2912 -s 572
  2⤵
  PID:2848

memory/2912-0-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/2912-1-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp

Filesize
9.9MB

Download
memory/2912-2-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2912-3-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp

Filesize
9.9MB

Download
memory/2912-4-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download