6abcd9fb461fa338bf4019afe56fdb6bf2e645db0f1749ed3e158533f5676829

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28/03/2023, 10:27

Target

0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe
Size

1.9MB
MD5

56591e392123df2b09aaa9831d38a4d4
SHA1

3b05874b950d71eeda9eb3a59b74f821013ad70a
SHA256

0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956
SHA512

55b090b09672333d589200e05379e516d9fea4b32da02369da0386b01f735803cb915bf4278c68091d993a55b3c2d5535b7abb5e7720e1ec5513ebd01693a413
SSDEEP

12288:yxWcZoObfOS+9YGsJwAl01c3l1+RobUCmf2bx3zBX3yF+EKFhDzP3UZ9xE9jKB3y:WfDdGsJm1OVmfihmevP3r9jKB3nwPg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
608	1676	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 608	1676	0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe	28
PID 1676 wrote to memory of 608	1676	0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe	28
PID 1676 wrote to memory of 608	1676	0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe	28

C:\Users\Admin\AppData\Local\Temp\0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe
"C:\Users\Admin\AppData\Local\Temp\0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1676 -s 896
  2⤵
  - Program crash
  PID:608

memory/1676-54-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/1676-55-0x000000001B2A0000-0x000000001B320000-memory.dmp

Filesize
512KB

Download
memory/1676-56-0x000000001B2A0000-0x000000001B320000-memory.dmp

Filesize
512KB

Download