3ac8de904ccc9c514abd3d8cfcc00dc1d47618a0f7571e0fe59d008dccd800bf | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

seroxen.lib.exe
Size

11KB
MD5

0006cb738bb3fc2793930226863339e2
SHA1

ab6bcc485b0ed514d6c11a1108852fddcce98e79
SHA256

3ac8de904ccc9c514abd3d8cfcc00dc1d47618a0f7571e0fe59d008dccd800bf
SHA512

fb2f9db8a87c84d9bb88b51fac88e6dadc97e01769e31b22beef6be2f7ba47c58f14cc95f1aacfc57c4a7ed83f9858623ee68b493f4a5cce60de2f2a4ce99ffe
SSDEEP

192:Q3zNDc4i6+CtdTOeovPSj1oseD9WqWSVX/DOo:CS4Z+wdTOeovP2NeVLO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4396	3552	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	seroxen.lib.exe

C:\Users\Admin\AppData\Local\Temp\seroxen.lib.exe
"C:\Users\Admin\AppData\Local\Temp\seroxen.lib.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1416
  2⤵
  - Program crash
  PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3552 -ip 3552
1⤵
PID:4832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3552-0-0x000000007512E000-0x000000007512F000-memory.dmp

Filesize
4KB

Download
memory/3552-1-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/3552-2-0x0000000075120000-0x00000000758D0000-memory.dmp

Filesize
7.7MB

Download
memory/3552-3-0x0000000075120000-0x00000000758D0000-memory.dmp

Filesize
7.7MB

Download