df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de

Analysis

max time kernel
261s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 21:59

Target

df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe
Size

77KB
MD5

feda011534943d50b61dec02cefa816c
SHA1

aba56280c4cbfb4179015ff13103574c02e20aff
SHA256

df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de
SHA512

8e405850440e0af5530859ba528e8d3270098067a8feb46b4f44c1936e1b8872be4369bf8a124d6fd80f777c44d200b476429caa1ad498ecff979f297482f4f1
SSDEEP

1536:COd/jW5DYdE+uuZDlxPGsCX8kRWLdDTHWamsVJwIPSHwJ33L0x7kcI1wjX:C4/jW5DYdE+ugT2xRgd/yJqlV70ZkI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	1940	WerFault.exe	19

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1940	df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1652	1940	df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe	28
PID 1940 wrote to memory of 1652	1940	df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe	28
PID 1940 wrote to memory of 1652	1940	df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe	28
PID 1940 wrote to memory of 1652	1940	df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe	28

C:\Users\Admin\AppData\Local\Temp\df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe
"C:\Users\Admin\AppData\Local\Temp\df365bd47b4d05c2ec506d714216a3163a0bfecca752ef5c3ceee4767e3e57de.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 232
  2⤵
  - Program crash
  PID:1652

memory/1940-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1940-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1940-56-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1940-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download