51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26

Resubmissions

16/10/2022, 11:14

16/10/2022, 10:55

max time kernel
316s
max time network
347s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/10/2022, 11:14

Target

51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26.exe
Size

4.0MB
MD5

a2287613c53f1a3ac79628f138221339
SHA1

b0a2fa9f4c02c79e004c2028c145a8bd779d44c7
SHA256

51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26
SHA512

2a82262d38037f35a4cea17caacb887c8234d70ad8d87eb21260bd6fa3db2820db5de7814a8dd6b9986c1893199aceab9befb7d7e323a1b72ec9f35f5fc0b92d
SSDEEP

98304:eFKLuV9+qmC4+ntFjpyJhOrU2S4NiizWRwGEL1wFRquoTv:QV4qI+t1py/OrUo0iWRrowXoT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	1388	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2000	1388	51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26.exe	28
PID 1388 wrote to memory of 2000	1388	51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26.exe	28
PID 1388 wrote to memory of 2000	1388	51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26.exe	28

C:\Users\Admin\AppData\Local\Temp\51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26.exe
"C:\Users\Admin\AppData\Local\Temp\51cb8ce9a305fe049a17da02e398cc27f1adfc54f4351160fd5f8095cbc37c26.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1388 -s 936
  2⤵
  - Program crash
  PID:2000

memory/1388-54-0x0000000001290000-0x00000000016A0000-memory.dmp

Filesize
4.1MB

Download
memory/1388-55-0x000000001C320000-0x000000001C652000-memory.dmp

Filesize
3.2MB

Download
memory/1388-56-0x00000000011F6000-0x0000000001215000-memory.dmp

Filesize
124KB

Download
memory/1388-57-0x000000001AF50000-0x000000001B274000-memory.dmp

Filesize
3.1MB

Download
memory/1388-58-0x0000000023610000-0x000000002383A000-memory.dmp

Filesize
2.2MB

Download
memory/1388-59-0x0000000076D10000-0x0000000076EB9000-memory.dmp

Filesize
1.7MB

Download
memory/1388-61-0x0000000076D10000-0x0000000076EB9000-memory.dmp

Filesize
1.7MB

Download
memory/1388-62-0x00000000011F6000-0x0000000001215000-memory.dmp

Filesize
124KB

Download