531e29b34f525987ef3210689b417ea3c1a0b4f5c8bcf180ef00148a3e6d0b1f

Resubmissions

01-07-2024 08:03

01-07-2024 08:00

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:00

Target

Project Execution Order - (PO 546788) (PO 546789).exe
Size

38KB
MD5

246238533bb596d52737946aaf4b4d37
SHA1

8c350aff45dbb05c1d61eb885a13b591544b70fa
SHA256

531e29b34f525987ef3210689b417ea3c1a0b4f5c8bcf180ef00148a3e6d0b1f
SHA512

8e5a0bd7a5dce0bf1927ade856aec94f2cb6ee611a832f8178fa7ede5199614b137cb8a5cb001b5d34afd9a8a0628967e68d3759e4b323ea887c59f2b8dda98e
SSDEEP

384:fsNjci832cy7jQNDy1SXNh2xEPICOVvHX9RL7D6p05iVXXXtXXXXXXtX41hoJOuy:vHwL7D6Shho16G+SIp1b5tPeWTU

Score

7^/10

Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
agilenet

Processes:

resource yara_rule

behavioral1/memory/2132-1-0x0000000000CA0000-0x0000000000CB0000-memory.dmp agile_net
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2328 2132 WerFault.exe Project Execution Order - (PO 546788) (PO 546789).exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Project Execution Order - (PO 546788) (PO 546789).exe

description pid process

Token: SeDebugPrivilege 2132 Project Execution Order - (PO 546788) (PO 546789).exe

resource	yara_rule
behavioral1/memory/2132-1-0x0000000000CA0000-0x0000000000CB0000-memory.dmp	agile_net

pid	pid_target	process	target process
2328	2132	WerFault.exe	Project Execution Order - (PO 546788) (PO 546789).exe

description	pid	process
Token: SeDebugPrivilege	2132	Project Execution Order - (PO 546788) (PO 546789).exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Project Execution Order - (PO 546788) (PO 546789).exe

description	pid	process	target process
PID 2132 wrote to memory of 2328	2132	Project Execution Order - (PO 546788) (PO 546789).exe	WerFault.exe
PID 2132 wrote to memory of 2328	2132	Project Execution Order - (PO 546788) (PO 546789).exe	WerFault.exe
PID 2132 wrote to memory of 2328	2132	Project Execution Order - (PO 546788) (PO 546789).exe	WerFault.exe
PID 2132 wrote to memory of 2328	2132	Project Execution Order - (PO 546788) (PO 546789).exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 1152
2⤵
- Program crash
PID:2328

memory/2132-0-0x0000000074CDE000-0x0000000074CDF000-memory.dmp

Filesize
4KB

Download
memory/2132-1-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Filesize
64KB

Download
memory/2132-2-0x0000000074CD0000-0x00000000753BE000-memory.dmp

Filesize
6.9MB

Download
memory/2132-3-0x0000000074CDE000-0x0000000074CDF000-memory.dmp

Filesize
4KB

Download
memory/2132-4-0x0000000074CD0000-0x00000000753BE000-memory.dmp

Filesize
6.9MB

Download