00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271

Resubmissions

22-09-2022 16:59

20-09-2022 10:36

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-09-2022 16:59

Target

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
Size

39KB
MD5

ec263f6b3a0ec7ede4960a2db469fb4e
SHA1

6684ec275e168f999d27f8a2b1f83dcc0ac1ff8f
SHA256

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271
SHA512

51391cc61514cf68b7789c8646315fba04f66c821b0f9dc4bd8d684ea377069f596ff3dfe999e342e580d7139d4967bfe47e1d11ec5b5490173f104938546178
SSDEEP

768:eNkXrdzjDUp3vyE0WFBDiBZn/EvuuXY02pw0MU:eeXxzHUp3vyE0WFBeH/EvuI1I

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2004 544 WerFault.exe 00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

description pid process

Token: SeDebugPrivilege 544 00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

pid	pid_target	process	target process
2004	544	WerFault.exe	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

description	pid	process
Token: SeDebugPrivilege	544	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

description	pid	process	target process
PID 544 wrote to memory of 2004	544	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe	WerFault.exe
PID 544 wrote to memory of 2004	544	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe	WerFault.exe
PID 544 wrote to memory of 2004	544	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
"C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 544 -s 176
  2⤵
  - Program crash
  PID:2004