76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 10:26

Target

76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe
Size

787KB
MD5

a94234a6d9ad8404238718bd6b27f64c
SHA1

aed801d7eac6bef69a7c76e228ad3819e4b09edd
SHA256

76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286
SHA512

0d134c6648da84e7326498bf29d2b73867c40db37aab550350d7c3a9a40405cadf7de4f77dc46480805acca8b2e707360efbc916d278d7fa87727c749f8be8a6
SSDEEP

12288:4ABPJwKcIlr7O8BkFOHAnJfmrFchsUQuYs4r1+r/dHV+57RQzsp2JHUxOKOZ64u4:4ABhcar7O98AJurqgoMsTHJHUxj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4664 set thread context of 4144	4664	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	96

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	4144	WerFault.exe	96

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4144	4664	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	96
PID 4664 wrote to memory of 4144	4664	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	96
PID 4664 wrote to memory of 4144	4664	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	96
PID 4664 wrote to memory of 4144	4664	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	96
PID 4664 wrote to memory of 4144	4664	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	96
PID 4664 wrote to memory of 4144	4664	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	96

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4144 -ip 4144
1⤵
PID:3152

memory/4144-10-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4144-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4144-14-0x0000000001370000-0x00000000016BA000-memory.dmp

Filesize
3.3MB

Download
memory/4144-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4664-6-0x0000000008130000-0x00000000081CC000-memory.dmp

Filesize
624KB

Download
memory/4664-5-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Filesize
40KB

Download
memory/4664-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

Filesize
4KB

Download
memory/4664-7-0x00000000031D0000-0x00000000031E8000-memory.dmp

Filesize
96KB

Download
memory/4664-8-0x0000000003200000-0x0000000003210000-memory.dmp

Filesize
64KB

Download
memory/4664-9-0x000000000ABA0000-0x000000000AC2A000-memory.dmp

Filesize
552KB

Download
memory/4664-4-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/4664-12-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/4664-3-0x0000000007E20000-0x0000000007EB2000-memory.dmp

Filesize
584KB

Download
memory/4664-2-0x00000000083D0000-0x0000000008974000-memory.dmp

Filesize
5.6MB

Download
memory/4664-1-0x0000000000E80000-0x0000000000F4C000-memory.dmp

Filesize
816KB

Download