bd45e50b3ec1e76b4cc8c018131921f5237a356b1dcbc9ec69fdf9788edbea58

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/01/2023, 04:30

Target
payload.exe
Size 31KB
Sample230124-e4ty1agf85
SHA256 bd45e50b3ec1e76b4cc8c018131921f5237a356b1dcbc9ec69fdf9788edbea58
MD5 fcf99858964e59b68b0433b135b499bb
SHA1 817c9144632361468d2e9177d55c9f0598dfd234
SHA512 6281d9e78f3520c1050ac059679fb0742739077c64e474ac15bde11a221b3f1d1ada2dafd0688490633b36b7a5bd8c2f2833f8232569a4cc3699a69ed09f8463
SSDEEP 768:Awn0ja6MY6dPBBPkaRx98CCIzQMCzG17bDTjNGy9A:FnTldpRx98izQMCShpGy9A
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	1264	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	payload.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1452	1264	payload.exe	29
PID 1264 wrote to memory of 1452	1264	payload.exe	29
PID 1264 wrote to memory of 1452	1264	payload.exe	29

C:\Users\Admin\AppData\Local\Temp\payload.exe
"C:\Users\Admin\AppData\Local\Temp\payload.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1264 -s 552
  2⤵
  - Program crash
  PID:1452

memory/1264-54-0x0000000001290000-0x000000000129E000-memory.dmp

Download