4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 12:13

Target

4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe
Size

2.0MB
MD5

139c144ca9408f173a70f8836bbb1272
SHA1

7ae548fb936ad5af8eada8e2e4d1748ea9778fdf
SHA256

4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9
SHA512

569454c90eb9ce04be60eb250bc98a3c8e3ce745894103feaac5ad9e01b4b6bdee4e8f3b95f52d989ea5b76c6d62d128f77b6aef5e74e2c2d2c04862cb794c68
SSDEEP

24576:Kzs3yG2Rwd14jK42aMQDJoAOM08/85RkptVIJqPSkQ/7Gb8NLEbeZ:evRwdG2NcOMjUfkptVxqkQ/qoLEw

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
472	Process not Found
2060	alg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8f3ba34185fff97f.bin	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2236	4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1512	2236	4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe	32
PID 2236 wrote to memory of 1512	2236	4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe	32
PID 2236 wrote to memory of 1512	2236	4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe	32

C:\Users\Admin\AppData\Local\Temp\4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe
"C:\Users\Admin\AppData\Local\Temp\4c659d2e1debbdd876db4e96d7e63268943232c461a20fae880b23b2ad7d3aa9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2236 -s 328
  2⤵
  PID:1512

C:\Windows\System32\alg.exe

Filesize
644KB

MD5
a5ae9a2fb00436a9b3aecb0589a60fff

SHA1
2ea376fff5bb5b72c41902bdbdf6f05d64af91c4

SHA256
a894f18c9a42355b6e5e91a186bc6e12a0bbec764756aca61a985e3fe685183b

SHA512
ec73334e8c60442aacbbef1576fef2f8ed204e1f40e9a07773938abe15aa3c49b6a4cde76f03802df2a97a4f225cea1e49069eff55a499084b8d1331a17b3e6d

Download Submit
memory/2060-19-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/2060-23-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/2060-31-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/2060-30-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/2060-36-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/2236-0-0x00000000002E0000-0x0000000000340000-memory.dmp

Filesize
384KB

Download
memory/2236-9-0x00000000002E0000-0x0000000000340000-memory.dmp

Filesize
384KB

Download
memory/2236-8-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2236-35-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download