d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 14:43

Target

d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe
Size

368KB
MD5

500dbda4403f8f91f0a893c6c57b441d
SHA1

dd43960b19cd8810447f45f2e96a1557af36f9d4
SHA256

d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89
SHA512

a76b7cfdf1283db03624b8c73e9aee8b0542e907a5400a0b5b0f4206e937d66a7be9427f36f0191a1ec307b9d22b4d46b4092ca15a0583d3cf322435f4460c23
SSDEEP

1536:4doMDP3BnMPUC4wg0p2Z/jrF8wBKYfDHbifFGxsCdnrinleNn:4euPxnMPUHwpp2gBUqwxBNilYn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 1516 WerFault.exe d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe

description pid process

Token: SeDebugPrivilege 1516 d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe

pid	pid_target	process	target process
1684	1516	WerFault.exe	d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe

description	pid	process
Token: SeDebugPrivilege	1516	d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe

description	pid	process	target process
PID 1516 wrote to memory of 1684	1516	d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe	WerFault.exe
PID 1516 wrote to memory of 1684	1516	d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe	WerFault.exe
PID 1516 wrote to memory of 1684	1516	d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe	WerFault.exe
PID 1516 wrote to memory of 1684	1516	d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe
"C:\Users\Admin\AppData\Local\Temp\d33be5280d3218290d388d56c8b24a8384850d562728bbbe6d8a738950f76b89.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1068
  2⤵
  - Program crash
  PID:1684

memory/1516-54-0x0000000000B10000-0x0000000000B72000-memory.dmp

Filesize
392KB

Download
memory/1516-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1684-56-0x0000000000000000-mapping.dmp

Download