141607cb1599b9798567420990f586708ea2a3b12ebf5c3de43ae088fbbec870

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 20:50

Target

New folder (10)/Artic.exe
Size

9.1MB
MD5

a222517e57c3de9beb695be65f2b2cce
SHA1

d2c423dd84c8ba7bea6d1513be5233a7ffeb6878
SHA256

2a104aeb25c87c217ededd4f2dfb7c22f95196765e01ab70bcc16ed66fe7d8c9
SHA512

85e44314974b69bb2c7392784a699c52a954d4034773013cc02caf2bb8c9b2de961fac1704e4492726912619435024c0928af6b988b89b32209f3c113ab455c8
SSDEEP

196608:c0naZ/c/YLawDOsV3HyEpTLZuorLZIjBuS:cz/c/YLaTI3ppPEdB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1276	2140	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	Artic.exe

C:\Users\Admin\AppData\Local\Temp\New folder (10)\Artic.exe
"C:\Users\Admin\AppData\Local\Temp\New folder (10)\Artic.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 2264
  2⤵
  - Program crash
  PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2140 -ip 2140
1⤵
PID:4164

memory/2140-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

Filesize
4KB

Download
memory/2140-1-0x0000000000D20000-0x000000000164A000-memory.dmp

Filesize
9.2MB

Download
memory/2140-2-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download
memory/2140-3-0x00000000062A0000-0x0000000006A54000-memory.dmp

Filesize
7.7MB

Download
memory/2140-5-0x000000000BA10000-0x000000000BA1E000-memory.dmp

Filesize
56KB

Download
memory/2140-4-0x000000000BA30000-0x000000000BA68000-memory.dmp

Filesize
224KB

Download
memory/2140-7-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download