fd0b9f09770685ed6f40ecabcd31bc467fa22801164b52fdc638334009b7c06f

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/05/2023, 10:29

Target

fd0b9f09770685ed6f40ecabcd31bc467fa22801164b52fdc638334009b7c06f.exe
Size

367KB
MD5

3cbea05bf7a1affb821e379b1966d89c
SHA1

95f90554fb2ef20a64be9f6e81ff35c353392093
SHA256

fd0b9f09770685ed6f40ecabcd31bc467fa22801164b52fdc638334009b7c06f
SHA512

aa5b6e920ecae76a59a8f4afd6ab5e49e35478d1cfd2c03e6a4a8efab78c4556a37de5d8ab2401ef02c5de2cdc6da1ae56094fb5316f309212dda9cee4815f8d
SSDEEP

6144:dysu2PiMxOhV979ISqYp/0/vHDZPakPaeVAEtPhRybA6G:dDHqRqkAvjZbPa7E

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	1236	fd0b9f09770685ed6f40ecabcd31bc467fa22801164b52fdc638334009b7c06f.exe
Token: SeAssignPrimaryTokenPrivilege	1236	fd0b9f09770685ed6f40ecabcd31bc467fa22801164b52fdc638334009b7c06f.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1680	1236	fd0b9f09770685ed6f40ecabcd31bc467fa22801164b52fdc638334009b7c06f.exe	27

C:\Users\Admin\AppData\Local\Temp\fd0b9f09770685ed6f40ecabcd31bc467fa22801164b52fdc638334009b7c06f.exe
"C:\Users\Admin\AppData\Local\Temp\fd0b9f09770685ed6f40ecabcd31bc467fa22801164b52fdc638334009b7c06f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\System32\werfault.exe
  "C:\Windows\System32\werfault.exe"
  2⤵
  PID:1680