6b7204b9938cdc7e24b589faac4e12ed848c7121269899614b38bc95784845b9

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 16:36

Target
nr. comandă 5600885643.exe
Size 591KB
Sample221018-t384vsgdh9
SHA256 6b7204b9938cdc7e24b589faac4e12ed848c7121269899614b38bc95784845b9
MD5 baccd459f7f491fdaf2aeb16980eee82
SHA1 b28d071e71456898edf8f77afeb3cf1ec0d3d289
SHA512 08559c66282d772416d66950f319ad4f433daa6bdcef82ec5b907763c0eaddf36382e6e30fd243660f443dea70e82cc6cc06ecb3b3e63fa4bde9f22edc576af7
SSDEEP 12288:QRMJjXiDVXJtGuTsi7nw+6A1kkWTe08gjxMi:QSoC4Z7nw+6KHgjxM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
872	1976	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1976	nr. comandă 5600885643.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	nr. comandă 5600885643.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 872	1976	nr. comandă 5600885643.exe	28
PID 1976 wrote to memory of 872	1976	nr. comandă 5600885643.exe	28
PID 1976 wrote to memory of 872	1976	nr. comandă 5600885643.exe	28

C:\Users\Admin\AppData\Local\Temp\nr. comandă 5600885643.exe
"C:\Users\Admin\AppData\Local\Temp\nr. comandă 5600885643.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1976 -s 528
  2⤵
  - Program crash
  PID:872

memory/1976-54-0x0000000001300000-0x0000000001396000-memory.dmp

Download