266aa1bf199f3bd82bc8e708c177aeef4808e31c439f87d69b68efb8e07da996

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/01/2023, 04:41

Target
b85b35b1236f1931f9b1fa47425e796e.exe
Size 20.0MB
Sample230111-fa43jsec4v
SHA256 266aa1bf199f3bd82bc8e708c177aeef4808e31c439f87d69b68efb8e07da996
MD5 b85b35b1236f1931f9b1fa47425e796e
SHA1 713cb9730056a6e0dcf1237c5bbc63ef38cfc308
SHA512 ee5c4e48fcbed982b588ddd779b4892a0ab83f9371c3e59a2e620bd4b375e2c8462fe4774bffbafe03d78eac76b1b944ace151526bf9809a1a7e8f963626918e
SSDEEP 196608:+k/QutOxtP8yr6oKo/hYNiJId8OEoWz8w7O79T6jRBJ06e8anYq5VYvoLnu493xp:x6PI1o/GN068OTiT7FRU6gbVbnz3vM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1444	1036	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	b85b35b1236f1931f9b1fa47425e796e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1444	1036	b85b35b1236f1931f9b1fa47425e796e.exe	29
PID 1036 wrote to memory of 1444	1036	b85b35b1236f1931f9b1fa47425e796e.exe	29
PID 1036 wrote to memory of 1444	1036	b85b35b1236f1931f9b1fa47425e796e.exe	29

C:\Users\Admin\AppData\Local\Temp\b85b35b1236f1931f9b1fa47425e796e.exe
"C:\Users\Admin\AppData\Local\Temp\b85b35b1236f1931f9b1fa47425e796e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1036 -s 652
  2⤵
  - Program crash
  PID:1444

memory/1036-54-0x0000000000A90000-0x00000000018DC000-memory.dmp

Download