d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 21:10

Target

d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe
Size

2.0MB
MD5

56d8fbe0bedb5a9491ac64c27b1140c0
SHA1

ed2a33940e9e463a8030b28555474aa51adf55da
SHA256

d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e
SHA512

2f4a8ec46fc92206a59dbf1ea300eaa1688a00a8ae4ced303e3c97fa6fddba93aceb6944fd61c7d7a9e91a726d45888d823fa9a19d03c9cb7e0af4ed2ddab057
SSDEEP

24576:iBxcqhG/e37rZ83+zdToZJoAOM08/85RkptVIJqNsqjnhMgeiCl7G0nehbGZpbD:qgi7tbYOMjUfkptVxxDmg27RnWGj

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
480	Process not Found
2372	alg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b37e7fc0a4d605c0.bin	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2484	d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1952	2484	d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe	30
PID 2484 wrote to memory of 1952	2484	d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe	30
PID 2484 wrote to memory of 1952	2484	d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe	30

C:\Users\Admin\AppData\Local\Temp\d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe
"C:\Users\Admin\AppData\Local\Temp\d4e074d270c2305d9ad3eaa35a3bbebca7fe356ffed4465e87e21b5de8bd7d6e.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2484 -s 320
  2⤵
  PID:1952

\Windows\System32\alg.exe

Filesize
1.3MB

MD5
32327f4ce47ed1fce90fd9e031a645b2

SHA1
6dc940fa3adc781e97bb11f07f81ad22f7804e1f

SHA256
caaf89d5e01d901d007efbab60910de1c3d52c50cbf6362fa19406a5693b0919

SHA512
d1611c894d6bc9d12e461d3d2bb9e47236d246fbfc9eb8c8d0aceba0bd8f544da44d5abfa1eff9110fb9724a1944970169b9b9770aee5e30ae4cb24dd3aafb18

Download Submit
memory/2372-29-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/2372-23-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/2372-33-0x0000000100000000-0x00000001001E3000-memory.dmp

Filesize
1.9MB

Download
memory/2372-35-0x0000000100000000-0x00000001001E3000-memory.dmp

Filesize
1.9MB

Download
memory/2484-0-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Filesize
384KB

Download
memory/2484-8-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Filesize
384KB

Download
memory/2484-7-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Filesize
384KB

Download
memory/2484-6-0x0000000140000000-0x00000001401FB000-memory.dmp

Filesize
2.0MB

Download
memory/2484-34-0x0000000140000000-0x00000001401FB000-memory.dmp

Filesize
2.0MB

Download