46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4

Analysis

max time kernel
109s
max time network
185s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 22:19

Target

46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe
Size

8KB
MD5

302174015be125b26ee91320e43c0130
SHA1

c2b301f8ca409cd01e049c474fa4d0f07c7e1446
SHA256

46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4
SHA512

03be219bb54fe225d4d48b322a93ab2c17359e6154cce2f4f541851107a07c66057ff8509869ff226bfac8edf1f80330d679bf6b3be9eac086faf9706640f837
SSDEEP

96:fnrqObo9In2fU7+d1I6fdnvi+Cwc9VfQsvnVpOpM1Emp7qHIKOzNt://E9I2I+d1I6lnTFEvnepM1T8+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	944	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1264	944	46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe	28
PID 944 wrote to memory of 1264	944	46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe	28
PID 944 wrote to memory of 1264	944	46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe	28

C:\Users\Admin\AppData\Local\Temp\46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe
"C:\Users\Admin\AppData\Local\Temp\46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 944 -s 1040
  2⤵
  - Program crash
  PID:1264

memory/944-54-0x0000000000BD0000-0x0000000000BD8000-memory.dmp

Filesize
32KB

Download