7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:40

Target

7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe
Size

578KB
MD5

249b72362af18a1d8415e2545a4f9200
SHA1

7dd4cd8c6d8c2624f2341a8a3e9bf6da9d2f4030
SHA256

7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211
SHA512

f52824d8a14a4afb8eb1ef4fa3077c9e3475fca0c1abfa33ce0a243c6ca62d442d7740fc88683ef4f1ae3426c92d2cddae0d2adb5024e4e721d5d75fc4617071
SSDEEP

12288:soH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:n2JOt934J7Z6bQaj1BvUm9J

Score

7^/10

Executes dropped EXE 2 IoCs

Processes:

alg.exe

pid process

480
2884 alg.exe

pid	process
480
2884	alg.exe

Drops file in System32 directory 2 IoCs

Processes:

7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exealg.exe

description	ioc	process
File opened for modification	C:\Windows\System32\alg.exe	7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f89be6e478a61a12.bin	alg.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2224 2696 WerFault.exe 7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe

description pid process

Token: SeTakeOwnershipPrivilege 2696 7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe

pid	pid_target	process	target process
2224	2696	WerFault.exe	7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2696	7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe

description	pid	process	target process
PID 2696 wrote to memory of 2224	2696	7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe	WerFault.exe
PID 2696 wrote to memory of 2224	2696	7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe	WerFault.exe
PID 2696 wrote to memory of 2224	2696	7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe	WerFault.exe
PID 2696 wrote to memory of 2224	2696	7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 340
2⤵
- Program crash
PID:2224

\Windows\System32\alg.exe
Filesize
644KB

MD5
6bc87b3aba6d04608f8d318872437753

SHA1
d10ba634992b372f4814eeb4f95c90f3736b0fdf

SHA256
f9286a9dff3d301e2d4162a464a0d432d270ce376755ec012d123b4b54efa162

SHA512
b40f3a2e205ac42e8b1bade2546cead3fef3c47140072e529dae24659addb0e61f866dc8f65919113e3a255f7084c14646336f3358f3b0ecef39b0dbb6af70f3

Download Submit
memory/2696-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2696-1-0x0000000001CC0000-0x0000000001D27000-memory.dmp

Filesize
412KB

Download
memory/2696-8-0x0000000001CC0000-0x0000000001D27000-memory.dmp

Filesize
412KB

Download
memory/2696-24-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2884-13-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/2884-14-0x0000000000450000-0x00000000004B0000-memory.dmp

Filesize
384KB

Download
memory/2884-20-0x0000000000450000-0x00000000004B0000-memory.dmp

Filesize
384KB

Download
memory/2884-21-0x0000000000450000-0x00000000004B0000-memory.dmp

Filesize
384KB

Download
memory/2884-25-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download