ccb9d3a7cc935f66464aa88d4358cbd13bef0826349107d25a91950dd933174c

Analysis

max time kernel
34s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 15:13

Target

Sliver 5.exe
Size

26KB
MD5

abd39ef226be8e578acac90675358e4f
SHA1

d2c4f530dfa178fcf2996fdf2d6d8c0e446054db
SHA256

ccb9d3a7cc935f66464aa88d4358cbd13bef0826349107d25a91950dd933174c
SHA512

2a68ca7049943eef8e1daad62f988607e20427fb166548bc8358c528cfec0c5cc1a1c7bfdaf98934887ca93881d9315cb1d87b2e89e1c9f98fa554904f829bf8
SSDEEP

384:608VP28hobaQaUMOD8kB5bgkt4yW7XPcLtPbv6nmkbfJPBfwawUZaL+3jb0quH:Dtamft+P0lSnrfJPUUZVe

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/2436-1-0x0000000000DE0000-0x0000000000DEC000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 2436 WerFault.exe Sliver 5.exe

pid	pid_target	process	target process
1924	2436	WerFault.exe	Sliver 5.exe

C:\Users\Admin\AppData\Local\Temp\Sliver 5.exe
"C:\Users\Admin\AppData\Local\Temp\Sliver 5.exe"
1⤵
PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 848
  2⤵
  - Program crash
  PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2436 -ip 2436
1⤵
PID:4620

memory/2436-0-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/2436-1-0x0000000000DE0000-0x0000000000DEC000-memory.dmp

Filesize
48KB

Download
memory/2436-2-0x0000000005DF0000-0x0000000006396000-memory.dmp

Filesize
5.6MB

Download
memory/2436-3-0x00000000058E0000-0x0000000005972000-memory.dmp

Filesize
584KB

Download
memory/2436-4-0x0000000074890000-0x0000000075041000-memory.dmp

Filesize
7.7MB

Download
memory/2436-5-0x0000000074890000-0x0000000075041000-memory.dmp

Filesize
7.7MB

Download