850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 23:34

Target

850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe
Size

4.0MB
MD5

72c548097b679b745295a4d02e0ab2ff
SHA1

780334ff0e1553e28579dba5196dea410d3766f3
SHA256

850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c
SHA512

d445f4fe56c2d8e740a4f117057ea3a1e512c22211659eeb2a22be447db418aa0953baf4f2e9bc45b3991264b2197f13c3a8bb7729a2f41953bcca0615d7635c
SSDEEP

49152:7G/1d593R/hFcx3atpxylbkbXw6YWfr3gq4hU2eUWVqxlMHusr+vdiOeKLgxI:7G/LvR/EzIEsrFIUvqxsusr+1beqP

Score

9^/10

agilenet

Detects executables packed with Babel 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2748-1-0x0000000000C70000-0x0000000001072000-memory.dmp	INDICATOR_EXE_Packed_Babel

Detects executables packed with Dotfuscator 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2748-1-0x0000000000C70000-0x0000000001072000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with Goliath 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2748-1-0x0000000000C70000-0x0000000001072000-memory.dmp	INDICATOR_EXE_Packed_Goliath

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2748-1-0x0000000000C70000-0x0000000001072000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral2/memory/2748-1-0x0000000000C70000-0x0000000001072000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 2748 WerFault.exe 850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

description pid process

Token: SeDebugPrivilege 2748 850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

pid	pid_target	process	target process
1020	2748	WerFault.exe	850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

description	pid	process
Token: SeDebugPrivilege	2748	850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe

C:\Users\Admin\AppData\Local\Temp\850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe
"C:\Users\Admin\AppData\Local\Temp\850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 1036
2⤵
- Program crash
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2748 -ip 2748
1⤵
PID:1076

memory/2748-0-0x00000000749CE000-0x00000000749CF000-memory.dmp

Filesize
4KB

Download
memory/2748-1-0x0000000000C70000-0x0000000001072000-memory.dmp

Filesize
4.0MB

Download
memory/2748-2-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/2748-3-0x0000000006270000-0x0000000006814000-memory.dmp

Filesize
5.6MB

Download
memory/2748-4-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download