ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8

Resubmissions

27-04-2024 22:30

27-04-2024 22:14

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:14

Target

immortal.bin.exe
Size

1.1MB
MD5

9e511d399fbc2bf0c2d45302dc62be61
SHA1

3100c1c0c5f98b1a7bccef0cdcfde6b34e38992b
SHA256

ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8
SHA512

7e4560bd6e76d181b47f44eca0a7195cb905e852ed2a94308cad57576a16c62335256978c73ddac275d736423c5c6a9a4eed648090847ee80e8183be77c04486
SSDEEP

24576:fO29aTBMPYvJnXAvKhO7CMbNdCrty7ARVJ3g6cbhbZxvI:G29adQt3CrtWQcb3xv

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1888	immortal.bin.exe
1888	immortal.bin.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	1888	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	immortal.bin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	immortal.bin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2640	1888	immortal.bin.exe	29
PID 1888 wrote to memory of 2640	1888	immortal.bin.exe	29
PID 1888 wrote to memory of 2640	1888	immortal.bin.exe	29
PID 1888 wrote to memory of 2640	1888	immortal.bin.exe	29

C:\Users\Admin\AppData\Local\Temp\immortal.bin.exe
"C:\Users\Admin\AppData\Local\Temp\immortal.bin.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1160
  2⤵
  - Program crash
  PID:2640

memory/1888-0-0x0000000000D40000-0x00000000010AE000-memory.dmp

Filesize
3.4MB

Download
memory/1888-2-0x0000000074590000-0x0000000074C7E000-memory.dmp

Filesize
6.9MB

Download
memory/1888-1-0x0000000000D40000-0x00000000010AE000-memory.dmp

Filesize
3.4MB

Download
memory/1888-3-0x0000000000D40000-0x00000000010AE000-memory.dmp

Filesize
3.4MB

Download
memory/1888-4-0x00000000059F0000-0x0000000005A30000-memory.dmp

Filesize
256KB

Download
memory/1888-6-0x0000000000D40000-0x00000000010AE000-memory.dmp

Filesize
3.4MB

Download
memory/1888-8-0x0000000074590000-0x0000000074C7E000-memory.dmp

Filesize
6.9MB

Download
memory/1888-9-0x00000000059F0000-0x0000000005A30000-memory.dmp

Filesize
256KB

Download