2bff54b9373397bb78dc3dd57f37b85affb564edec73fbb265e9a14d313a2a1d

Analysis

max time kernel
64s
max time network
56s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/01/2023, 16:28

Target
INV20230104-BR.exe
Size 7KB
Sample230104-tym1tscb8z
SHA256 2bff54b9373397bb78dc3dd57f37b85affb564edec73fbb265e9a14d313a2a1d
MD5 7ff9457d0721e01547b556e0c833594c
SHA1 5963c193d856ead444804089ff3f147902c4afe5
SHA512 a3ae95d38a479d563e64674bda4673a4e91eebb1bfe72768a3469d33b4f3c5569662961657fcdfd72526aabe975f4a5b7a07d03c93d4553e017cb215da4b5e68
SSDEEP 96:/wlDWr5PYwMrAobmeXEV2rYvyIohMjZjVtokjr1Zw6kU+nzz1YdaKNp6Ny3EKzNF:4D+PYwMrzEfKm1VtoEsHU+nzHZy5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1488	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	INV20230104-BR.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2016	1488	INV20230104-BR.exe	28
PID 1488 wrote to memory of 2016	1488	INV20230104-BR.exe	28
PID 1488 wrote to memory of 2016	1488	INV20230104-BR.exe	28
PID 1488 wrote to memory of 2016	1488	INV20230104-BR.exe	28

C:\Users\Admin\AppData\Local\Temp\INV20230104-BR.exe
"C:\Users\Admin\AppData\Local\Temp\INV20230104-BR.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 1556
  2⤵
  - Program crash
  PID:2016

memory/1488-54-0x0000000000940000-0x0000000000948000-memory.dmp

Download

memory/1488-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Download