9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675

Resubmissions

16/10/2022, 11:14

16/10/2022, 10:56

max time kernel
49s
max time network
275s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/10/2022, 11:14

Target

9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe
Size

3.9MB
MD5

d8dfac398555e946ecc533198738f8c6
SHA1

35f4571b7efe542d6a5b7681d8d9276274c0d52d
SHA256

9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675
SHA512

5df2fd14453cd47f3db78ba48b9771253033e05807feead7c7174738f5d5ea6b18a47f68d55f88fb9d9d2dbac25f3af2d2bbad9f3087ef1b330d2c43c35b4939
SSDEEP

98304:a9KhGI6eXdNk/kgz/3lvoYXHbpEYpJDW5sRhjQFfy:aqD6eXPBQ/3lwYXlEYphWmRqy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	1700	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1560	1700	9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe	28
PID 1700 wrote to memory of 1560	1700	9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe	28
PID 1700 wrote to memory of 1560	1700	9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe	28

C:\Users\Admin\AppData\Local\Temp\9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe
"C:\Users\Admin\AppData\Local\Temp\9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1700 -s 1220
  2⤵
  - Program crash
  PID:1560

memory/1700-54-0x0000000001290000-0x0000000001682000-memory.dmp

Filesize
3.9MB

Download
memory/1700-55-0x000000001C5E0000-0x000000001C948000-memory.dmp

Filesize
3.4MB

Download
memory/1700-56-0x00000000010E6000-0x0000000001105000-memory.dmp

Filesize
124KB

Download
memory/1700-57-0x000000001C140000-0x000000001C49C000-memory.dmp

Filesize
3.4MB

Download
memory/1700-58-0x0000000023D70000-0x0000000023FFE000-memory.dmp

Filesize
2.6MB

Download
memory/1700-59-0x0000000076DC0000-0x0000000076F69000-memory.dmp

Filesize
1.7MB

Download
memory/1700-60-0x0000000076DC0000-0x0000000076F69000-memory.dmp

Filesize
1.7MB

Download
memory/1700-62-0x0000000076DC0000-0x0000000076F69000-memory.dmp

Filesize
1.7MB

Download