73e86b788261e8a4b97b6922627e3710235f97a69d68d9f950f195dbf0481687

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 23:05

Target

02_2019_Order_Package_20180329_06575998876_2019_signed.exe
Size

947KB
MD5

a0618e93947b2aeb2275200f18b4ae6b
SHA1

d3f3b4741a04877a06c9307cf7d0e0daa9d48e36
SHA256

7737901daf766eed03fa7a2bd4317a71760bd680fdadd4a827431774d984757a
SHA512

33c5c6b4d555e87775b6680dd5dd25f009f94b0fd05876dc63344e5ee0d52d2df940923db819ff31437bb4132f94a73c70390596b63d643bb7d58b73dd80c09d
SSDEEP

12288:+JsocMd7RpR66ri/hp4vKNZUuOKE0Cgoe4fLYwLcfCLFSLfmez:+m3w7Rb66+/YhM8fecYKcqZSH

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/2884-8-0x0000000000580000-0x000000000058A000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2836 2884 WerFault.exe 02_2019_Order_Package_20180329_06575998876_2019_signed.exe

pid	pid_target	process	target process
2836	2884	WerFault.exe	02_2019_Order_Package_20180329_06575998876_2019_signed.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

02_2019_Order_Package_20180329_06575998876_2019_signed.exe

description	pid	process
Token: SeDebugPrivilege	2884	02_2019_Order_Package_20180329_06575998876_2019_signed.exe
Token: 33	2884	02_2019_Order_Package_20180329_06575998876_2019_signed.exe
Token: SeIncBasePriorityPrivilege	2884	02_2019_Order_Package_20180329_06575998876_2019_signed.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

02_2019_Order_Package_20180329_06575998876_2019_signed.exe

description	pid	process	target process
PID 2884 wrote to memory of 2836	2884	02_2019_Order_Package_20180329_06575998876_2019_signed.exe	WerFault.exe
PID 2884 wrote to memory of 2836	2884	02_2019_Order_Package_20180329_06575998876_2019_signed.exe	WerFault.exe
PID 2884 wrote to memory of 2836	2884	02_2019_Order_Package_20180329_06575998876_2019_signed.exe	WerFault.exe
PID 2884 wrote to memory of 2836	2884	02_2019_Order_Package_20180329_06575998876_2019_signed.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 916
2⤵
- Program crash
PID:2836

memory/2884-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2884-1-0x00000000010D0000-0x00000000011BE000-memory.dmp

Filesize
952KB

Download
memory/2884-2-0x0000000000510000-0x0000000000540000-memory.dmp

Filesize
192KB

Download
memory/2884-3-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2884-4-0x0000000000470000-0x000000000047E000-memory.dmp

Filesize
56KB

Download
memory/2884-5-0x0000000000590000-0x0000000000598000-memory.dmp

Filesize
32KB

Download
memory/2884-6-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2884-7-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2884-8-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download