4f59429fb16674587e462f66c5732b51d211df9bcce758eec5b31046f05a2d60

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 16:41

Target

BootsTrapperU.exe
Size

165KB
MD5

8b57e3af9a6b863fbe0746db752eba75
SHA1

bca3c16f360dc795cb31882c04c9ff0ec4d20511
SHA256

ee6e94dcb0f4bb34d487919faee67b4c178daee696d5bc84b229a24c8cad1c6f
SHA512

1799155f917d2a47691745c71b9e5dcb5b21e05fd5a7ae3105a6375bf2a5b5fdf944fc773177f670ea051bf0098a5c9685e14dba67c676fb0a5cdb51f46e4add
SSDEEP

3072:wxhMfvkWEpAJvlOT/NAWCNsxi8fdMznFHTfgCkPbQN982cUJWVgVK5o6V9207o0+:wxCfvkWEe9hWc8fdMFHrsPbbo742wb3B

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

884 2040 WerFault.exe BootsTrapperU.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

BootsTrapperU.exe

pid process

2040 BootsTrapperU.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

BootsTrapperU.exe

description pid process

Token: SeDebugPrivilege 2040 BootsTrapperU.exe

pid	pid_target	process	target process
884	2040	WerFault.exe	BootsTrapperU.exe

pid	process
2040	BootsTrapperU.exe

description	pid	process
Token: SeDebugPrivilege	2040	BootsTrapperU.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

BootsTrapperU.exe

description	pid	process	target process
PID 2040 wrote to memory of 884	2040	BootsTrapperU.exe	WerFault.exe
PID 2040 wrote to memory of 884	2040	BootsTrapperU.exe	WerFault.exe
PID 2040 wrote to memory of 884	2040	BootsTrapperU.exe	WerFault.exe
PID 2040 wrote to memory of 884	2040	BootsTrapperU.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1544
2⤵
- Program crash
PID:884

memory/2040-54-0x0000000001150000-0x0000000001182000-memory.dmp

Filesize
200KB

Download
memory/2040-55-0x0000000006E60000-0x0000000006EA0000-memory.dmp

Filesize
256KB

Download
memory/2040-56-0x0000000006E60000-0x0000000006EA0000-memory.dmp

Filesize
256KB

Download
memory/2040-57-0x00000000006B0000-0x00000000006BA000-memory.dmp

Filesize
40KB

Download
memory/2040-58-0x00000000006B0000-0x00000000006BA000-memory.dmp

Filesize
40KB

Download
memory/2040-59-0x0000000004590000-0x0000000004591000-memory.dmp

Filesize
4KB

Download
memory/2040-60-0x0000000006E60000-0x0000000006EA0000-memory.dmp

Filesize
256KB

Download
memory/2040-61-0x0000000006E60000-0x0000000006EA0000-memory.dmp

Filesize
256KB

Download
memory/2040-62-0x00000000006B0000-0x00000000006BA000-memory.dmp

Filesize
40KB

Download