ac931c4ea874554e800420be6fefc8e27346ee36fdecb9a3115a9b0886e191b4

Analysis

max time kernel
46s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 08:51

Target

Roasting.Crypter.exe
Size

15.2MB
MD5

458a650e8ef697d8461ab03683f1e359
SHA1

41e83617a68017b6547e63a687bf68f661190d75
SHA256

ac931c4ea874554e800420be6fefc8e27346ee36fdecb9a3115a9b0886e191b4
SHA512

6c3beb4f08b41d5917244c74f55ca965415b4f4a2c896ad7795a800756a722b1b5cfa3e6133e054b4c0f62a8fe0edbce64476a92fed440ce5ebf994e36cfbf8d
SSDEEP

196608:fAQzAg6xcPHBpCulvihuCiUHEjM9gl5jDsqGnVoNiFbuJqIcc8b8:fQg6GHBpX7CSmjoMFUcc

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3008	5040	WerFault.exe	79
3260	5040	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	Roasting.Crypter.exe

C:\Users\Admin\AppData\Local\Temp\Roasting.Crypter.exe
"C:\Users\Admin\AppData\Local\Temp\Roasting.Crypter.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1500
  2⤵
  - Program crash
  PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1488
  2⤵
  - Program crash
  PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 5040 -ip 5040
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 5040 -ip 5040
1⤵
PID:3964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4712

memory/5040-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

Filesize
4KB

Download
memory/5040-1-0x00000000004F0000-0x000000000142E000-memory.dmp

Filesize
15.2MB

Download
memory/5040-2-0x0000000005E30000-0x0000000005ECC000-memory.dmp

Filesize
624KB

Download
memory/5040-3-0x00000000064A0000-0x0000000006A44000-memory.dmp

Filesize
5.6MB

Download
memory/5040-4-0x0000000005F90000-0x0000000006022000-memory.dmp

Filesize
584KB

Download
memory/5040-5-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/5040-6-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/5040-7-0x0000000005F10000-0x0000000005F1A000-memory.dmp

Filesize
40KB

Download
memory/5040-8-0x0000000006140000-0x0000000006196000-memory.dmp

Filesize
344KB

Download
memory/5040-9-0x000000000BA10000-0x000000000C292000-memory.dmp

Filesize
8.5MB

Download
memory/5040-10-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/5040-11-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download