0c8296da5ca468087ecaeac3bb9b4475f075ae0ba654c9cc05a017f96d974d98

Analysis

max time kernel
29s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 17:25

Target
5673b49b2aea57b5ffce4fd4eb3e5311.exe
Size 455KB
Sample221202-vzbvmagh29
SHA256 0c8296da5ca468087ecaeac3bb9b4475f075ae0ba654c9cc05a017f96d974d98
MD5 5673b49b2aea57b5ffce4fd4eb3e5311
SHA1 ae67e414e4c7f9bfda56938e14f7a9a992abdb80
SHA512 0d5a902c133e2e8fbb2d29aea536b0404c170b68fbcf51f194e37f9f61fee4c23d6c510807658a97673fe66040fcd951b335457c1d785ca655167f4a40d69e4e
SSDEEP 12288:Rxgjr9v7Kg5TFbcZ4C1yjDZZbenSSkmXUIDCYCCHE+STxIU:RxgJ7ZuejDZZben/xXUIDCYCCHE+STxI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
892	1360	WerFault.exe	20

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 892	1360	5673b49b2aea57b5ffce4fd4eb3e5311.exe	28
PID 1360 wrote to memory of 892	1360	5673b49b2aea57b5ffce4fd4eb3e5311.exe	28
PID 1360 wrote to memory of 892	1360	5673b49b2aea57b5ffce4fd4eb3e5311.exe	28

C:\Users\Admin\AppData\Local\Temp\5673b49b2aea57b5ffce4fd4eb3e5311.exe
"C:\Users\Admin\AppData\Local\Temp\5673b49b2aea57b5ffce4fd4eb3e5311.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1360 -s 524
  2⤵
  - Program crash
  PID:892

memory/1360-54-0x00000000010C0000-0x0000000001136000-memory.dmp

Download