141607cb1599b9798567420990f586708ea2a3b12ebf5c3de43ae088fbbec870

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 20:50

Target

New folder (10)/Artic.exe
Size

9.1MB
MD5

a222517e57c3de9beb695be65f2b2cce
SHA1

d2c423dd84c8ba7bea6d1513be5233a7ffeb6878
SHA256

2a104aeb25c87c217ededd4f2dfb7c22f95196765e01ab70bcc16ed66fe7d8c9
SHA512

85e44314974b69bb2c7392784a699c52a954d4034773013cc02caf2bb8c9b2de961fac1704e4492726912619435024c0928af6b988b89b32209f3c113ab455c8
SSDEEP

196608:c0naZ/c/YLawDOsV3HyEpTLZuorLZIjBuS:cz/c/YLaTI3ppPEdB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	2300	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	Artic.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2984	2300	Artic.exe	28
PID 2300 wrote to memory of 2984	2300	Artic.exe	28
PID 2300 wrote to memory of 2984	2300	Artic.exe	28
PID 2300 wrote to memory of 2984	2300	Artic.exe	28

C:\Users\Admin\AppData\Local\Temp\New folder (10)\Artic.exe
"C:\Users\Admin\AppData\Local\Temp\New folder (10)\Artic.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1452
  2⤵
  - Program crash
  PID:2984

memory/2300-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/2300-1-0x0000000001310000-0x0000000001C3A000-memory.dmp

Filesize
9.2MB

Download
memory/2300-2-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-3-0x00000000055C0000-0x0000000005D74000-memory.dmp

Filesize
7.7MB

Download
memory/2300-4-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/2300-5-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/2300-7-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/2300-8-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-10-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/2300-9-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download