d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b

Analysis

max time kernel
47s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 04:51

Target

d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe
Size

72KB
MD5

5079154263b86be4e2b45dae0c50fab9
SHA1

756555c8db7c963171d2d618947c55ea40ec3c74
SHA256

d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b
SHA512

d550193b3051a51da16f2342445964a0120f4c1d5a45a531bac84e627852b0a1bc25dc1b075074e6ea40d86050c7c52160db1e62096de446772c874fc7a0ea06
SSDEEP

1536:fcKbHUWFoVLlMBECMJKMbzFJwDNU/N7v6YtL03p:f1RFgLmB1M/bEDNAJv6YJ05

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1760	WerFault.exe	19

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1760	d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1760	d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1900	1760	d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe	28
PID 1760 wrote to memory of 1900	1760	d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe	28
PID 1760 wrote to memory of 1900	1760	d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe	28
PID 1760 wrote to memory of 1900	1760	d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe	28

C:\Users\Admin\AppData\Local\Temp\d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe
"C:\Users\Admin\AppData\Local\Temp\d214f4f07f9ff2905c3fded7529f43c158cdf29c67df5de9ff3e695828e55f8b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 300
  2⤵
  - Program crash
  PID:1900

memory/1760-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1760-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1760-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1760-58-0x00000000004F0000-0x00000000004F9000-memory.dmp

Filesize
36KB

Download
memory/1760-59-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download