ca1906c0038d784d0ae122797eb5a2c359aeabd142efa34f709c229bec4cd3cc

Analysis

max time kernel
32s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 05:03

Target

L2Server/Loader.exe
Size

7.2MB
MD5

fa7d5c4c0d738f90cfb4cce4e5164570
SHA1

0e3764f87d5875de0929efcff684091372ed3086
SHA256

e2f4ce4f66cf6e537485203b2ea299c8b22c1c577ba4da94080312a6f5c228fd
SHA512

4a046d1c105e3f5d08550eff955e1e1199e5510fb3cfdb8afef9af64bdee5d9a09ce520dc6307b21cc674805bac5ae054908638c0ddf51f8104ea74c839d0007
SSDEEP

49152:gSjCbvvRJsvifKhO+KFZ6X8Cdt2bHu6ECnOzgdAA0OtI2HUVUrKDbRpjmLLZsUeT:mbvRJQKFZ6X2zxKnRp8Z0j3r4Fox08

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1492	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1492	Loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1172	1492	Loader.exe	26
PID 1492 wrote to memory of 1172	1492	Loader.exe	26
PID 1492 wrote to memory of 1172	1492	Loader.exe	26

C:\Users\Admin\AppData\Local\Temp\L2Server\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\L2Server\Loader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1492 -s 280628
  2⤵
  - Program crash
  PID:1172