9356d56bc50ab9c3138c1508dde0c7f91732aa2a49ba0dc047777c33dc4ad7d6

Analysis

max time kernel
31s
max time network
132s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/05/2023, 12:16

Target

file.exe
Size

11KB
MD5

8d361274685c6e905923e1743cff08e7
SHA1

c24c935d442e531a18cdf4c5cff3b92feda8d008
SHA256

9356d56bc50ab9c3138c1508dde0c7f91732aa2a49ba0dc047777c33dc4ad7d6
SHA512

166bb6f89a4a5685b5749c9284a81e385dff7361235b1ff1782338e912bbd765ae918cb4deb52fae5701f43a0fad144d86ff6250cf9c92f86f4e6f55f30b744d
SSDEEP

96:Zgd9i15VpHbKNK8Zwr0jE9yv1Kxv+FTIPcZhLCzjDwIv8+yU0Qb7DzNt:lpHwKG49ydK1+FEcZhiYSNyIbJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1160	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1948	1160	file.exe	27
PID 1160 wrote to memory of 1948	1160	file.exe	27
PID 1160 wrote to memory of 1948	1160	file.exe	27
PID 1160 wrote to memory of 1948	1160	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 1760
  2⤵
  - Program crash
  PID:1948

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D11.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/1160-54-0x0000000000040000-0x0000000000048000-memory.dmp

Filesize
32KB

Download
memory/1160-55-0x0000000001FD0000-0x0000000002010000-memory.dmp

Filesize
256KB

Download
memory/1160-113-0x0000000001FD0000-0x0000000002010000-memory.dmp

Filesize
256KB

Download