56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3

Analysis

max time kernel
46s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 06:15

Target

56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3.exe
Size

2.5MB
MD5

ead3fa688d54821749ce8560a88113e5
SHA1

93c0c48274af4ffb3b0fa98863c95d74b60ab84c
SHA256

56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3
SHA512

0c50542b71bd9a77b2f667a0f72e2849260905ed996699a803158c0df386c8f281adf14b5e96d92f1e5f75a297e88cff0319fd3513139fadec989d85dfd3bec1
SSDEEP

49152:ulw6djeMyapIeRmY0jOXYiY+mYqdfmVaHjiEYJ1S2cUDboibqIZcBmO:ul9mYeOIiYftfpGRJ1SxYvbqI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
112	1768	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 112	1768	56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3.exe	27
PID 1768 wrote to memory of 112	1768	56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3.exe	27
PID 1768 wrote to memory of 112	1768	56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3.exe	27
PID 1768 wrote to memory of 112	1768	56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3.exe	27

C:\Users\Admin\AppData\Local\Temp\56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3.exe
"C:\Users\Admin\AppData\Local\Temp\56f9da62175893c10b82e902c4b5679c77f28e25c388fed61906bd7fc52452b3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1036
  2⤵
  - Program crash
  PID:112

memory/112-56-0x0000000000000000-mapping.dmp

Download
memory/1768-54-0x0000000000D30000-0x0000000000FAC000-memory.dmp

Filesize
2.5MB

Download
memory/1768-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download