2927fa7b9ae197d2df871b2ee8e49cf3e59351eac0c9c4c2b6e7d40dfc4e74c8

Analysis

max time kernel
9s
max time network
3s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 17:26

Target

83IsdTn.exe
Size

3.7MB
MD5

4e2d575368122f3cb45566d218615186
SHA1

e8f549da555de2222ac310d2cac8cab387e7da39
SHA256

2927fa7b9ae197d2df871b2ee8e49cf3e59351eac0c9c4c2b6e7d40dfc4e74c8
SHA512

d998bd63abd922f3771ff16ef5c8a81afb1444643e27ed23807e061a40cba2fa1c125cc6dec65a665748adc5c7555a2f92d36889a1d9022d60cfb234efc5b7a4
SSDEEP

98304:XC9zijxlrYonhJZYMnv7zt98Qf8yobcTGL:XCNerDD+Mv7zt98qbobcTQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2060	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2060	83IsdTn.exe
2060	83IsdTn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	83IsdTn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2208	2060	83IsdTn.exe	29
PID 2060 wrote to memory of 2208	2060	83IsdTn.exe	29
PID 2060 wrote to memory of 2208	2060	83IsdTn.exe	29
PID 2060 wrote to memory of 2208	2060	83IsdTn.exe	29

C:\Users\Admin\AppData\Local\Temp\83IsdTn.exe
"C:\Users\Admin\AppData\Local\Temp\83IsdTn.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 716
  2⤵
  - Program crash
  PID:2208

memory/2060-54-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-55-0x0000000000BB0000-0x000000000115C000-memory.dmp

Filesize
5.7MB

Download
memory/2060-56-0x00000000096F0000-0x0000000009730000-memory.dmp

Filesize
256KB

Download
memory/2060-57-0x0000000009500000-0x00000000095FC000-memory.dmp

Filesize
1008KB

Download
memory/2060-58-0x00000000096F0000-0x0000000009730000-memory.dmp

Filesize
256KB

Download
memory/2060-59-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download