4ee574fe1dfeccd0651989b4dd2a774c485025e9c3268ad4eb06a96ec4305680

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 14:00

Target

Windowsϵͳ©޸.exe
Size

1.5MB
MD5

5d7fb79b1f7b3c64eeca9ea0cedf18be
SHA1

d4be8a3fe5e1c571fdd36fcf363953d859c220da
SHA256

8565f1895133fa044efe5ac563bb394bcd529622cb6d79541dca74d41d6d31eb
SHA512

d4ecf193fb68423c409313ece8d3464c9a49a704ff21df120b98a034b333bd32061f99f35aae6f73a07f7cba06f05952a173033b442a94ec6fd948d3b8ee9363
SSDEEP

24576:yzbV+Aa3WN+6Ptlz43GCvTySJVsSx2sel6H5ziqyH+J4eIxoXBdcGcnXG:Zv3W+6Pw3XFsVss0ziqyHWooXrct

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1840 976 WerFault.exe Windowsϵͳ©޸.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Windowsϵͳ©޸.exe

pid process

976 Windowsϵͳ©޸.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Windowsϵͳ©޸.exe

description pid process

Token: SeDebugPrivilege 976 Windowsϵͳ©޸.exe

pid	pid_target	process	target process
1840	976	WerFault.exe	Windowsϵͳ©޸.exe

pid	process
976	Windowsϵͳ©޸.exe

description	pid	process
Token: SeDebugPrivilege	976	Windowsϵͳ©޸.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Windowsϵͳ©޸.exe

description	pid	process	target process
PID 976 wrote to memory of 1840	976	Windowsϵͳ©޸.exe	WerFault.exe
PID 976 wrote to memory of 1840	976	Windowsϵͳ©޸.exe	WerFault.exe
PID 976 wrote to memory of 1840	976	Windowsϵͳ©޸.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Windowsϵͳ©޸.exe
"C:\Users\Admin\AppData\Local\Temp\Windowsϵͳ©޸.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 976 -s 580
  2⤵
  - Program crash
  PID:1840

memory/976-54-0x00000000001A0000-0x000000000045A000-memory.dmp

Filesize
2.7MB

Download
memory/976-56-0x0000000000150000-0x0000000000172000-memory.dmp

Filesize
136KB

Download
memory/976-65-0x0000000000460000-0x0000000000486000-memory.dmp

Filesize
152KB

Download
memory/976-74-0x000000001A820000-0x000000001A888000-memory.dmp

Filesize
416KB

Download
memory/976-82-0x0000000000150000-0x0000000000172000-memory.dmp

Filesize
136KB

Download
memory/976-83-0x0000000000460000-0x0000000000486000-memory.dmp

Filesize
152KB

Download
memory/976-84-0x000000001A820000-0x000000001A888000-memory.dmp

Filesize
416KB

Download
memory/1840-85-0x0000000000000000-mapping.dmp

Download