55ca03b4f0a73d8c2fb54ded501c1b537d70cd7dd7b11bc6760d0180afcea5e3

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 17:41

Target

20184887cc360cee738b358dd896d315.exe
Size

24KB
MD5

20184887cc360cee738b358dd896d315
SHA1

2e2cde781bef22778afe217ae92268b112e21196
SHA256

55ca03b4f0a73d8c2fb54ded501c1b537d70cd7dd7b11bc6760d0180afcea5e3
SHA512

c9e7b18872121a49908117f96a122b0ca420bef1fe6fa9701eeb8aebe872f97abf04396ae224acf8ec29b2bdc9e7bddfa7d72722df79f227eefff650d4a1da2a
SSDEEP

384:9xg8LhcvtTqguhLZxKsNKdEPpcclXmFr0kA1GMIvP3wxffH:9xg8LSvt+lhLXKm5PGIXW5nW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	1876	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	20184887cc360cee738b358dd896d315.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2804	1876	20184887cc360cee738b358dd896d315.exe	28
PID 1876 wrote to memory of 2804	1876	20184887cc360cee738b358dd896d315.exe	28
PID 1876 wrote to memory of 2804	1876	20184887cc360cee738b358dd896d315.exe	28
PID 1876 wrote to memory of 2804	1876	20184887cc360cee738b358dd896d315.exe	28

C:\Users\Admin\AppData\Local\Temp\20184887cc360cee738b358dd896d315.exe
"C:\Users\Admin\AppData\Local\Temp\20184887cc360cee738b358dd896d315.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 1248
  2⤵
  - Program crash
  PID:2804

memory/1876-54-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Filesize
48KB

Download
memory/1876-55-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/1876-56-0x0000000004870000-0x00000000048B0000-memory.dmp

Filesize
256KB

Download
memory/1876-57-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/1876-58-0x0000000004870000-0x00000000048B0000-memory.dmp

Filesize
256KB

Download