07a72d61154c37817fbb112e37e8a108886857d588c3df46cce7d84d92ca8ec6

Analysis

max time kernel
131s
max time network
152s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 18:49

Target

0e67384a4b89fb49f8f007af35122955cbf1d310.exe
Size

7KB
MD5

872ee416b911925c61ddd11d2f3eeb7b
SHA1

0e67384a4b89fb49f8f007af35122955cbf1d310
SHA256

07a72d61154c37817fbb112e37e8a108886857d588c3df46cce7d84d92ca8ec6
SHA512

bb61899323d423147724ab9556006791452ae0d27c73c0fd07f1b4882c06f96001d7db154bab6e479c75137bf112656b9a79de499e79ddb189b982663f8e7977
SSDEEP

96:BG+1jsTi+wX7GEmPbnfK6IoP8ZY7ZMt5vdQ6k2CttLzNt:BG+eW+wXC9bfXPgGHf3N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	940	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	0e67384a4b89fb49f8f007af35122955cbf1d310.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1736	940	0e67384a4b89fb49f8f007af35122955cbf1d310.exe	28
PID 940 wrote to memory of 1736	940	0e67384a4b89fb49f8f007af35122955cbf1d310.exe	28
PID 940 wrote to memory of 1736	940	0e67384a4b89fb49f8f007af35122955cbf1d310.exe	28
PID 940 wrote to memory of 1736	940	0e67384a4b89fb49f8f007af35122955cbf1d310.exe	28

C:\Users\Admin\AppData\Local\Temp\0e67384a4b89fb49f8f007af35122955cbf1d310.exe
"C:\Users\Admin\AppData\Local\Temp\0e67384a4b89fb49f8f007af35122955cbf1d310.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 1236
  2⤵
  - Program crash
  PID:1736

memory/940-54-0x0000000001160000-0x0000000001168000-memory.dmp

Filesize
32KB

Download
memory/940-55-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download