2a79200fffad2a413bee9185e3486870a797c29495650036aea53833ccffc00e

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-08-2022 19:10

Target

75ab2193c88d9af9a4f2b9fe95157cc7.exe
Size

5KB
MD5

75ab2193c88d9af9a4f2b9fe95157cc7
SHA1

23492919d39898420822158fa8bf8d80c8832f8d
SHA256

2a79200fffad2a413bee9185e3486870a797c29495650036aea53833ccffc00e
SHA512

168ff3424f62951100863664b76754c273aa72fdfd121bf40aa7e527b5e9a1b3e96f6053dc0cd02c43aaa71028041f7efd1332e9acd665c7c513a849f4f957d8
SSDEEP

48:6+ybkEucZ4nyUN6a5MOlCtcC0heFNMO+yEP+96R5JfJyC3JUsibkEs3dqZsFtoAK:eucZ4VpUt0h2+yEpTdoSysivuD/zNt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1240 2004 WerFault.exe 75ab2193c88d9af9a4f2b9fe95157cc7.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

75ab2193c88d9af9a4f2b9fe95157cc7.exe

description pid process

Token: SeDebugPrivilege 2004 75ab2193c88d9af9a4f2b9fe95157cc7.exe

pid	pid_target	process	target process
1240	2004	WerFault.exe	75ab2193c88d9af9a4f2b9fe95157cc7.exe

description	pid	process
Token: SeDebugPrivilege	2004	75ab2193c88d9af9a4f2b9fe95157cc7.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

75ab2193c88d9af9a4f2b9fe95157cc7.exe

description	pid	process	target process
PID 2004 wrote to memory of 1240	2004	75ab2193c88d9af9a4f2b9fe95157cc7.exe	WerFault.exe
PID 2004 wrote to memory of 1240	2004	75ab2193c88d9af9a4f2b9fe95157cc7.exe	WerFault.exe
PID 2004 wrote to memory of 1240	2004	75ab2193c88d9af9a4f2b9fe95157cc7.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2004 -s 1080
2⤵
- Program crash
PID:1240

memory/1240-55-0x0000000000000000-mapping.dmp

Download
memory/2004-54-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download