bfa82ccb728c0ba5533bfc1093487edb9d06ab10080b915c64b759ca86b0d9f5

Analysis

max time kernel
39s
max time network
68s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 12:25

Target

SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe
Size

83KB
MD5

437cdc9cd5aa816864a2d1f6ec30d23c
SHA1

23b7a7c73604cd3ad97ca77062f6fc1c8be67376
SHA256

bfa82ccb728c0ba5533bfc1093487edb9d06ab10080b915c64b759ca86b0d9f5
SHA512

9639697764ea464f5617d809bd6883bcc7e71349082665d41e80a63f23c5cb8a1a0d7d74019a33434bf32391b2f365778203a11102b83a8beb1a10586610b450
SSDEEP

1536:+QWI/CRcoIpDJM7ojtOTNH7zpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLr4uixPCb:xWIo4DJM7ojtOTNH7zpga/eHUTQQQQQ4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	2004	WerFault.exe	15

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 844	2004	SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe	28
PID 2004 wrote to memory of 844	2004	SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe	28
PID 2004 wrote to memory of 844	2004	SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe	28
PID 2004 wrote to memory of 844	2004	SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.6714.12779.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 1164
  2⤵
  - Program crash
  PID:844

memory/2004-54-0x0000000000160000-0x000000000017A000-memory.dmp

Filesize
104KB

Download
memory/2004-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2004-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download