b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 11:04

Target

b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe
Size

684KB
MD5

07e733c42963ff7a665fce7b25ff1320
SHA1

ce2c8481e181b266d6c7c252f66fb5fe39f137db
SHA256

b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d
SHA512

b84bf28e9f6cbaf05c4a11c2b3d744f734c175c5cf82c2b58891f1f7454ef3a112ac1aab2705baf132007ba40776a979761896363a00e7784948d1ea0b023d9f
SSDEEP

6144:1CYwO2yBPGNDl8zoFE+VA8Jl/z1SAAoQ32YD1cvmBoeq7LnWl/6VAmONUGdqjNf5:1CYwO28+Nwl4A8Jl/J4WwoeqmgAnNwNX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	1756	WerFault.exe	17

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe
1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe
1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1340	1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe	28
PID 1756 wrote to memory of 1340	1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe	28
PID 1756 wrote to memory of 1340	1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe	28
PID 1756 wrote to memory of 1340	1756	b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe	28

C:\Users\Admin\AppData\Local\Temp\b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe
"C:\Users\Admin\AppData\Local\Temp\b0f58df001d24b74cdc448e3f077123721b81afc6c42fc4da403a65dc463b48d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 288
  2⤵
  - Program crash
  PID:1340

memory/1756-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download