Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 01:16
Static task
static1
Behavioral task
behavioral1
Sample
2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe
Resource
win10v2004-20240226-en
General
-
Target
2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe
-
Size
791KB
-
MD5
c4a6297b79141d28849a7d5c3a7f046c
-
SHA1
65fc3f8aff2aade19bc0a9c4fbd6ecaf9f94d071
-
SHA256
2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3
-
SHA512
b96822fb3bc8abca6c4d2301a20e730b73ab93306ee22f408a05910eb6904a9db186134986384f7a1a5462f532760d39f6bb20885e5801472726af328e166015
-
SSDEEP
12288:xIlWET/mr9K+22BEEzFatnv1KakJkeYXrluEyfXfKDhOJodTVWWUjy0CUTrLJXgX:KWtb3BEN1QCrEEESDh9TVWFy0CQy
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exedescription pid process target process PID 2288 set thread context of 2536 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2540 2536 WerFault.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exepid process 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2536 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exedescription pid process Token: SeDebugPrivilege 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exedescription pid process target process PID 2288 wrote to memory of 3000 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 3000 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 3000 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 3000 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 2536 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 2536 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 2536 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 2536 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 2536 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 2536 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2288 wrote to memory of 2536 2288 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe PID 2536 wrote to memory of 2540 2536 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe WerFault.exe PID 2536 wrote to memory of 2540 2536 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe WerFault.exe PID 2536 wrote to memory of 2540 2536 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe WerFault.exe PID 2536 wrote to memory of 2540 2536 2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe"C:\Users\Admin\AppData\Local\Temp\2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe"C:\Users\Admin\AppData\Local\Temp\2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe"2⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe"C:\Users\Admin\AppData\Local\Temp\2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 363⤵
- Program crash
PID:2540