afd6f032a7122889f53d345acb9232749052768aa15fd2221266c5ddcbc4cc0e

Analysis

max time kernel
51s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/10/2022, 00:41

Target

PO#15032016-A001.exe
Size

1.2MB
MD5

4a459848e43d10b447d4997bea214005
SHA1

960172ec5db6c14fb13c88c720b185f54c134e49
SHA256

3b59835c11f8038ab2a4a12e4b6e0f8fe8758287c78d90c463f4e05f965d53a4
SHA512

a8b0105fc6c83a2c24495b75c6ee72c4245e4cb7b96413bfe7140ac8686547c932456db0e754b22e9d0ba2371e7b3edd17cc075854ac7af5a69bea73e575cda3
SSDEEP

24576:NLDO8fK9xek6lUNRIMDMG1XHa9i62pItX/f:5fsxe7GAMYG1K9uC/f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
888	1504	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	PO#15032016-A001.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	PO#15032016-A001.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 888	1504	PO#15032016-A001.exe	26
PID 1504 wrote to memory of 888	1504	PO#15032016-A001.exe	26
PID 1504 wrote to memory of 888	1504	PO#15032016-A001.exe	26
PID 1504 wrote to memory of 888	1504	PO#15032016-A001.exe	26

C:\Users\Admin\AppData\Local\Temp\PO#15032016-A001.exe
"C:\Users\Admin\AppData\Local\Temp\PO#15032016-A001.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 840
  2⤵
  - Program crash
  PID:888

memory/1504-54-0x0000000000D50000-0x0000000000E86000-memory.dmp

Filesize
1.2MB

Download
memory/1504-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-56-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/1504-57-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/1504-58-0x000000000A490000-0x000000000A562000-memory.dmp

Filesize
840KB

Download