9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675

Resubmissions

16/10/2022, 11:14

16/10/2022, 10:56

max time kernel
48s
max time network
272s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/10/2022, 10:56

Target

9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe
Size

3.9MB
MD5

d8dfac398555e946ecc533198738f8c6
SHA1

35f4571b7efe542d6a5b7681d8d9276274c0d52d
SHA256

9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675
SHA512

5df2fd14453cd47f3db78ba48b9771253033e05807feead7c7174738f5d5ea6b18a47f68d55f88fb9d9d2dbac25f3af2d2bbad9f3087ef1b330d2c43c35b4939
SSDEEP

98304:a9KhGI6eXdNk/kgz/3lvoYXHbpEYpJDW5sRhjQFfy:aqD6eXPBQ/3lwYXlEYphWmRqy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1380	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1496	1380	9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe	28
PID 1380 wrote to memory of 1496	1380	9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe	28
PID 1380 wrote to memory of 1496	1380	9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe	28

C:\Users\Admin\AppData\Local\Temp\9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe
"C:\Users\Admin\AppData\Local\Temp\9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1380 -s 944
  2⤵
  - Program crash
  PID:1496

memory/1380-54-0x0000000000BC0000-0x0000000000FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1380-55-0x000000001C290000-0x000000001C5F8000-memory.dmp

Filesize
3.4MB

Download
memory/1380-56-0x000000001BC96000-0x000000001BCB5000-memory.dmp

Filesize
124KB

Download
memory/1380-57-0x000000001AC10000-0x000000001AF6C000-memory.dmp

Filesize
3.4MB

Download
memory/1380-58-0x0000000023C50000-0x0000000023EDE000-memory.dmp

Filesize
2.6MB

Download
memory/1380-59-0x0000000076DB0000-0x0000000076F59000-memory.dmp

Filesize
1.7MB

Download
memory/1380-60-0x0000000076DB0000-0x0000000076F59000-memory.dmp

Filesize
1.7MB

Download
memory/1380-62-0x0000000076DB0000-0x0000000076F59000-memory.dmp

Filesize
1.7MB

Download