58fd04fe003160c5aca2e839d8588bd86b9a2b3ddcd8e3ddd5616182e9d9c45f

Analysis

max time kernel
40s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 10:45

Target
file.exe
Size 460KB
Sample221202-mtfbvsdd4t
SHA256 58fd04fe003160c5aca2e839d8588bd86b9a2b3ddcd8e3ddd5616182e9d9c45f
MD5 628f92d2f72e354115c37c23c371dfdf
SHA1 b56ba706666fd6d2ed64a3d8ca062ee95c0c1343
SHA512 76874d02452941bd55a1bbbca6d1328c97429029f76e35890fa11c51d4187acbbbb9dac1867c4dd2b11a24ffd1485460513d0b18376cedd406fc60a7e8edac0e
SSDEEP 6144:EkNuTazUksHSAnL5GQpDKzv3XTWjfkz3SGPfppG16uLolTAoelLeyW:EeuTNklAnjVK7XTW4DSG3bGNKAFlLeyW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1212	1004	WerFault.exe	16

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	file.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1212	1004	file.exe	28
PID 1004 wrote to memory of 1212	1004	file.exe	28
PID 1004 wrote to memory of 1212	1004	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1004 -s 528
  2⤵
  - Program crash
  PID:1212

memory/1004-54-0x0000000001180000-0x00000000011F6000-memory.dmp

Download