41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 16:28

Target

41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe
Size

663KB
MD5

248dd4b74e1c5bb0b98bf460803f5855
SHA1

1db70ff693138a4e149c676f827984d606237b33
SHA256

41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5
SHA512

6ba3140a825e13d64d9f08b0cda5421a09deec66c375a0c128cebec3b0ec3e590d53e26cff212dbe8a9fb48b9d14350000da580b0c2631bc5e3e2af5aa43afff
SSDEEP

12288:g0HPvPrHXKlB8YD1jADVp7EFJiZY+JFMVXXkgYc5+ctzwNymve:zPXmoc1jAhpoFJGN7IHVFSyZ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4548 set thread context of 3776	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	3776	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe
4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe
3776	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe
3776	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3184	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	86
PID 4548 wrote to memory of 3184	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	86
PID 4548 wrote to memory of 3184	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	86
PID 4548 wrote to memory of 3776	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	87
PID 4548 wrote to memory of 3776	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	87
PID 4548 wrote to memory of 3776	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	87
PID 4548 wrote to memory of 3776	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	87
PID 4548 wrote to memory of 3776	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	87
PID 4548 wrote to memory of 3776	4548	41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe	87

C:\Users\Admin\AppData\Local\Temp\41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe
"C:\Users\Admin\AppData\Local\Temp\41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe
  "C:\Users\Admin\AppData\Local\Temp\41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe"
  2⤵
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe
  "C:\Users\Admin\AppData\Local\Temp\41f33dccdb9abc41c8804f0df10d053561eb7539f809dc9161acc6bfcdb40ae5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 184
    3⤵
    - Program crash
    PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3776 -ip 3776
1⤵
PID:5096

memory/3776-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3776-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3776-15-0x0000000001A50000-0x0000000001D9A000-memory.dmp

Filesize
3.3MB

Download
memory/3776-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4548-4-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4548-5-0x0000000005350000-0x000000000535A000-memory.dmp

Filesize
40KB

Download
memory/4548-6-0x00000000055D0000-0x000000000566C000-memory.dmp

Filesize
624KB

Download
memory/4548-7-0x00000000055B0000-0x00000000055C2000-memory.dmp

Filesize
72KB

Download
memory/4548-8-0x00000000065E0000-0x00000000065E8000-memory.dmp

Filesize
32KB

Download
memory/4548-9-0x0000000006600000-0x000000000660E000-memory.dmp

Filesize
56KB

Download
memory/4548-10-0x0000000006670000-0x00000000066FE000-memory.dmp

Filesize
568KB

Download
memory/4548-0-0x000000007459E000-0x000000007459F000-memory.dmp

Filesize
4KB

Download
memory/4548-3-0x0000000005370000-0x0000000005402000-memory.dmp

Filesize
584KB

Download
memory/4548-14-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4548-2-0x0000000005920000-0x0000000005EC4000-memory.dmp

Filesize
5.6MB

Download
memory/4548-1-0x00000000008A0000-0x000000000094C000-memory.dmp

Filesize
688KB

Download