468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09

Analysis

max time kernel
44s
max time network
134s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 08:12

Target

468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe
Size

269KB
MD5

7cdbd0d8be7406c37d3d1bf1b380ce80
SHA1

33da76d9ad31771f561cc741e66793b1cbda3ed9
SHA256

468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09
SHA512

bd2e1ac491abec82ddb2e178a04f8e071d4e824bce682390361ded3a949733c534545ed238496bbc9eec119b859a84ea916d81c7abbda6c1ba3c95319e518494
SSDEEP

6144:FZCXgV4TJ1t7pvefpXyP5M+CqfIMLR5Pmie4:PCe4d9veRixMGL/T

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\taskmgr.exe	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	2012	WerFault.exe	18

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2012	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe
2012	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe
2012	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2032	2012	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe	29
PID 2012 wrote to memory of 2032	2012	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe	29
PID 2012 wrote to memory of 2032	2012	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe	29
PID 2012 wrote to memory of 2032	2012	468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe	29

C:\Users\Admin\AppData\Local\Temp\468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe
"C:\Users\Admin\AppData\Local\Temp\468bd182319df736d9707ffc6bfbeca3bf156c2240b07e2c820f230978018c09.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 1492
  2⤵
  - Program crash
  PID:2032

memory/2012-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2012-57-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2012-59-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download