6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/01/2023, 22:17

Target

6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb.exe
Size

1.2MB
MD5

ba53c8e0f9791f8e5f45e2c02e733f13
SHA1

d69647626d0beb5779450916a4fa89d3e4adb2bb
SHA256

6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb
SHA512

2d5e61fbb3e7364217a0eaad88f7fa8cf92b611cd0b5a56fe55bf8db050e323b1ab5940ea05ad14238de52d66d2a07e8cf1b542954919f763483c7e9d0c6cbd0
SSDEEP

24576:Dkyrk3eXEORnGOLogpmdhrquAgBh6jbgtca+ZuJ:YeUsRKkUtcM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	2000	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1116	2000	6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb.exe	28
PID 2000 wrote to memory of 1116	2000	6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb.exe	28
PID 2000 wrote to memory of 1116	2000	6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb.exe	28
PID 2000 wrote to memory of 1116	2000	6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb.exe	28

C:\Users\Admin\AppData\Local\Temp\6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb.exe
"C:\Users\Admin\AppData\Local\Temp\6147a8896c15a367f51c6eff3309f58196d72efc6ff756e4e55ff74cc9d26bfb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 91312
  2⤵
  - Program crash
  PID:1116

memory/2000-54-0x0000000000220000-0x000000000035A000-memory.dmp

Filesize
1.2MB

Download