9ad04d600dc3386601424f93a0dbbe03faddbdff3ed2284d75232ed4f35ff0be

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 22:34

Target

abcb8a7cc29a6251f48b3d2f655e6aa527c9252785e05358c8b41b77da900b75.exe
Size

9KB
MD5

1c4f83c457756eb6ce3761c4d0b3d0b0
SHA1

6c5b0a4fa7148e94d3530190250982394c1ca67e
SHA256

abcb8a7cc29a6251f48b3d2f655e6aa527c9252785e05358c8b41b77da900b75
SHA512

a23be69b2c24dd3ecefedc9612bb0c069cf7b12f98d8920adfac5e4b0364db4aaec352ce12e675791f1ec787ffd8cde909e175c1112640f9b9a713e9ab8e3e46
SSDEEP

192:MBksuXEXVwVCCTeMZZ3893VnjdwCzc3yXV:cVwhTeMAFnhwCQi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	1160	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	abcb8a7cc29a6251f48b3d2f655e6aa527c9252785e05358c8b41b77da900b75.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 996	1160	abcb8a7cc29a6251f48b3d2f655e6aa527c9252785e05358c8b41b77da900b75.exe	28
PID 1160 wrote to memory of 996	1160	abcb8a7cc29a6251f48b3d2f655e6aa527c9252785e05358c8b41b77da900b75.exe	28
PID 1160 wrote to memory of 996	1160	abcb8a7cc29a6251f48b3d2f655e6aa527c9252785e05358c8b41b77da900b75.exe	28

C:\Users\Admin\AppData\Local\Temp\abcb8a7cc29a6251f48b3d2f655e6aa527c9252785e05358c8b41b77da900b75.exe
"C:\Users\Admin\AppData\Local\Temp\abcb8a7cc29a6251f48b3d2f655e6aa527c9252785e05358c8b41b77da900b75.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1160 -s 900
  2⤵
  - Program crash
  PID:996

memory/1160-54-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/1160-55-0x000000001B400000-0x000000001B480000-memory.dmp

Filesize
512KB

Download
memory/1160-56-0x000000001B400000-0x000000001B480000-memory.dmp

Filesize
512KB

Download