8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9

Analysis

max time kernel
38s
max time network
40s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/01/2023, 10:24

Target

8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe
Size

23KB
MD5

e1a97bd74d5c83743b0e19c58553cac0
SHA1

9241ad2697577e1c9846bda6893a8f0ab626b812
SHA256

8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9
SHA512

25e04e1993a251edb61209292e647c3bbeb8a831805cab83ffbc875c682b56ac9ca154b088b990eb7087aa95d070cf41a267860b74c1d42d6a84ecd5b353dc10
SSDEEP

384:/C/FEFHfBot6c3aCV+ivCUK0qIHJTI79O7GoX1DH:MiHuKa+dUKMpP7ZN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1268	WerFault.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1268	8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1676	1268	8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe	26
PID 1268 wrote to memory of 1676	1268	8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe	26
PID 1268 wrote to memory of 1676	1268	8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe	26
PID 1268 wrote to memory of 1676	1268	8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe	26

C:\Users\Admin\AppData\Local\Temp\8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe
"C:\Users\Admin\AppData\Local\Temp\8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1524
  2⤵
  - Program crash
  PID:1676

memory/1268-54-0x0000000000110000-0x000000000011C000-memory.dmp

Filesize
48KB

Download
memory/1268-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download