ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8

Resubmissions

27-04-2024 22:30

27-04-2024 22:14

max time kernel
290s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:30

Target

immortal.bin.exe
Size

1.1MB
MD5

9e511d399fbc2bf0c2d45302dc62be61
SHA1

3100c1c0c5f98b1a7bccef0cdcfde6b34e38992b
SHA256

ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8
SHA512

7e4560bd6e76d181b47f44eca0a7195cb905e852ed2a94308cad57576a16c62335256978c73ddac275d736423c5c6a9a4eed648090847ee80e8183be77c04486
SSDEEP

24576:fO29aTBMPYvJnXAvKhO7CMbNdCrty7ARVJ3g6cbhbZxvI:G29adQt3CrtWQcb3xv

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

immortal.bin.exe

pid process

2276 immortal.bin.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3064 2276 WerFault.exe immortal.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

immortal.bin.exe

description pid process

Token: SeDebugPrivilege 2276 immortal.bin.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

immortal.bin.exe

pid process

2276 immortal.bin.exe

pid	process
2276	immortal.bin.exe

pid	pid_target	process	target process
3064	2276	WerFault.exe	immortal.bin.exe

description	pid	process
Token: SeDebugPrivilege	2276	immortal.bin.exe

pid	process
2276	immortal.bin.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

immortal.bin.exe

description	pid	process	target process
PID 2276 wrote to memory of 3064	2276	immortal.bin.exe	WerFault.exe
PID 2276 wrote to memory of 3064	2276	immortal.bin.exe	WerFault.exe
PID 2276 wrote to memory of 3064	2276	immortal.bin.exe	WerFault.exe
PID 2276 wrote to memory of 3064	2276	immortal.bin.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\immortal.bin.exe
"C:\Users\Admin\AppData\Local\Temp\immortal.bin.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1160
  2⤵
  - Program crash
  PID:3064

memory/2276-0-0x0000000000BB0000-0x0000000000F1E000-memory.dmp

Filesize
3.4MB

Download
memory/2276-3-0x0000000000BB0000-0x0000000000F1E000-memory.dmp

Filesize
3.4MB

Download
memory/2276-2-0x0000000073EA0000-0x000000007458E000-memory.dmp

Filesize
6.9MB

Download
memory/2276-1-0x0000000000BB0000-0x0000000000F1E000-memory.dmp

Filesize
3.4MB

Download
memory/2276-4-0x00000000051D0000-0x0000000005210000-memory.dmp

Filesize
256KB

Download
memory/2276-7-0x0000000073EA0000-0x000000007458E000-memory.dmp

Filesize
6.9MB

Download
memory/2276-8-0x00000000051D0000-0x0000000005210000-memory.dmp

Filesize
256KB

Download