850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe
Size

4.0MB
MD5

72c548097b679b745295a4d02e0ab2ff
SHA1

780334ff0e1553e28579dba5196dea410d3766f3
SHA256

850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c
SHA512

d445f4fe56c2d8e740a4f117057ea3a1e512c22211659eeb2a22be447db418aa0953baf4f2e9bc45b3991264b2197f13c3a8bb7729a2f41953bcca0615d7635c
SSDEEP

49152:7G/1d593R/hFcx3atpxylbkbXw6YWfr3gq4hU2eUWVqxlMHusr+vdiOeKLgxI:7G/LvR/EzIEsrFIUvqxsusr+1beqP

Score

9^/10

agilenet

Malware Config

Signatures

Detects executables packed with Babel 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1876-1-0x0000000000150000-0x0000000000552000-memory.dmp	INDICATOR_EXE_Packed_Babel

Detects executables packed with Dotfuscator 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1876-1-0x0000000000150000-0x0000000000552000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with Goliath 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1876-1-0x0000000000150000-0x0000000000552000-memory.dmp	INDICATOR_EXE_Packed_Goliath

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1876-1-0x0000000000150000-0x0000000000552000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1876-1-0x0000000000150000-0x0000000000552000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1224 1876 WerFault.exe 850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

description pid process

Token: SeDebugPrivilege 1876 850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

pid	pid_target	process	target process
1224	1876	WerFault.exe	850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

description	pid	process
Token: SeDebugPrivilege	1876	850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

description	pid	process	target process
PID 1876 wrote to memory of 1224	1876	850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe	WerFault.exe
PID 1876 wrote to memory of 1224	1876	850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe	WerFault.exe
PID 1876 wrote to memory of 1224	1876	850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe	WerFault.exe
PID 1876 wrote to memory of 1224	1876	850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe
"C:\Users\Admin\AppData\Local\Temp\850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 628
2⤵
- Program crash
PID:1224

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-0-0x00000000746EE000-0x00000000746EF000-memory.dmp

Filesize
4KB

Download
memory/1876-1-0x0000000000150000-0x0000000000552000-memory.dmp

Filesize
4.0MB

Download
memory/1876-2-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/1876-3-0x00000000746EE000-0x00000000746EF000-memory.dmp

Filesize
4KB

Download
memory/1876-4-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads