94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501

Analysis

max time kernel
68s
max time network
65s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 00:22

Target

94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501.exe
Size

45KB
MD5

0f1b18ba6bc12d3184e69b0236ce335c
SHA1

c69eecc04962aee6761653d658e56c21ce96500d
SHA256

94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501
SHA512

3f838bf25db5f95e42dcf80bcdf39b7f30b1fc09cb23f2975ceccec9c1fb61ca00570af92acb64982877056c260b8450942ad94974aabcff83b32c389c045368
SSDEEP

768:1Bv0xvm64z5O2R0S3ljRcBIr283GQIK0:M9al9LMHx3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	1416	WerFault.exe	14

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1072	1416	94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501.exe	26
PID 1416 wrote to memory of 1072	1416	94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501.exe	26
PID 1416 wrote to memory of 1072	1416	94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501.exe	26

C:\Users\Admin\AppData\Local\Temp\94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501.exe
"C:\Users\Admin\AppData\Local\Temp\94c84ba49eda3af8120cdcc3162695c2efede9e813509fdc8256e89f70049501.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1416 -s 1016
  2⤵
  - Program crash
  PID:1072

memory/1416-54-0x0000000000D50000-0x0000000000D60000-memory.dmp

Filesize
64KB

Download