a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53

Analysis

max time kernel
135s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 01:28

Target

a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe
Size

89KB
MD5

472d13b51c1129c19b95562e6302f686
SHA1

31c14c8da0ba3756501c483f668c275bb05d3d49
SHA256

a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53
SHA512

b2fc3b084539baf7f5ee6866cf8761f0a64133f61cee40d921ec2bbb543932501d3903f9aedd96616986438ec4180068667cf4f8352018159c69e49b7142f339
SSDEEP

1536:u9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:u9o6fK2XqXQwhnHlqQo8Lvy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2680 1116 WerFault.exe winver.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winver.exe

pid process

1116 winver.exe
1116 winver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Explorer.EXE

description pid process

Token: SeShutdownPrivilege 3536 Explorer.EXE
Token: SeCreatePagefilePrivilege 3536 Explorer.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

1116 winver.exe

pid	pid_target	process	target process
2680	1116	WerFault.exe	winver.exe

pid	process
1116	winver.exe
1116	winver.exe

description	pid	process
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE

pid	process
1116	winver.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exewinver.exe

description	pid	process	target process
PID 1612 wrote to memory of 1116	1612	a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe	winver.exe
PID 1612 wrote to memory of 1116	1612	a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe	winver.exe
PID 1612 wrote to memory of 1116	1612	a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe	winver.exe
PID 1612 wrote to memory of 1116	1612	a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe	winver.exe
PID 1116 wrote to memory of 3536	1116	winver.exe	Explorer.EXE
PID 1116 wrote to memory of 2660	1116	winver.exe	sihost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Users\Admin\AppData\Local\Temp\a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe
"C:\Users\Admin\AppData\Local\Temp\a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 632
4⤵
- Program crash
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1116 -ip 1116
1⤵
PID:4868

memory/1116-2-0x0000000000A90000-0x0000000000A96000-memory.dmp

Filesize
24KB

Download
memory/1116-8-0x00007FF9DB6F0000-0x00007FF9DB8E5000-memory.dmp

Filesize
2.0MB

Download
memory/1116-6-0x0000000077B12000-0x0000000077B13000-memory.dmp

Filesize
4KB

Download
memory/1116-13-0x0000000000A90000-0x0000000000A96000-memory.dmp

Filesize
24KB

Download
memory/1612-0-0x00000000006D0000-0x00000000006D2000-memory.dmp

Filesize
8KB

Download
memory/1612-5-0x0000000002360000-0x0000000002D60000-memory.dmp

Filesize
10.0MB

Download
memory/1612-9-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2660-10-0x0000000000F70000-0x0000000000F76000-memory.dmp

Filesize
24KB

Download
memory/2660-11-0x0000000000F70000-0x0000000000F76000-memory.dmp

Filesize
24KB

Download
memory/3536-4-0x0000000002C70000-0x0000000002C76000-memory.dmp

Filesize
24KB

Download
memory/3536-1-0x0000000002C70000-0x0000000002C76000-memory.dmp

Filesize
24KB

Download
memory/3536-7-0x00007FF9DB78D000-0x00007FF9DB78E000-memory.dmp

Filesize
4KB

Download