387ae43099fee9234854e9c8ebe1b4ae42c22f5b952446334c6335587899deee

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 16:01

Target

bin/k2epack/WStubs/lzma_solid.exe
Size

20KB
MD5

ab8dda5ef481e6ff7dd7531b1247db1c
SHA1

2def4a6d29f8684836de388a9da7673f4634c8af
SHA256

bf27c16769781d8a99a56c547110f0561688e5ac22a9739b1500dc800cb65806
SHA512

f50a4384bb1a38e1c05bc843c95a2b53d6f68df6ec52eb00ebeacc791a506b3f02d67c53233172d7ebf233530c0d45b7b293edf7770d96c8a51bfbbb47ca9d5a
SSDEEP

384:6T49rsikMZDcGxxdPoZ6DS8CpehOPn4pYmL/UAgqvkZdJZ:6sih2oUdQZ4xwezp83GUdJ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	5160	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\bin\k2epack\WStubs\lzma_solid.exe
"C:\Users\Admin\AppData\Local\Temp\bin\k2epack\WStubs\lzma_solid.exe"
1⤵
PID:5160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 804
  2⤵
  - Program crash
  PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5160 -ip 5160
1⤵
PID:4572

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact