cd1a3a3951014346894a253fa1a9dc05b221640be311dc679a83b4f91b1449f0

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 09:31

Target

Booking0217pdf.exe
Size

62KB
MD5

073a7d0ba4619b63b59e3f3c055a52e5
SHA1

e7e91c2f94f946627bfd4cae19a263e7d99861cc
SHA256

cd1a3a3951014346894a253fa1a9dc05b221640be311dc679a83b4f91b1449f0
SHA512

d1e359651d072d18c645b05e016c8407e2f9ca17693cfbd73a04bf7c163865df640ec7cb81ebfc79522cf2e84b22f3e5cb73be088ee4b200c3a5fe4185de3ebb
SSDEEP

768:4e9QoE/ASU2kRpqoOkAdsA9kWFXXtwboYzAF+IFqoZlO1iG8IYiV/eXlPxWEaB:4eid5kRpqIsdFn0Hz2qoFI7VeVPxu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	2892	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	Booking0217pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 3056	2892	Booking0217pdf.exe	28
PID 2892 wrote to memory of 3056	2892	Booking0217pdf.exe	28
PID 2892 wrote to memory of 3056	2892	Booking0217pdf.exe	28
PID 2892 wrote to memory of 3056	2892	Booking0217pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\Booking0217pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Booking0217pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 1252
  2⤵
  - Program crash
  PID:3056

memory/2892-54-0x0000000001290000-0x00000000012A4000-memory.dmp

Filesize
80KB

Download
memory/2892-55-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-56-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2892-57-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-58-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download