9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 15:06

Target

9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7_JC.exe
Size

174KB
MD5

ea9364c45c5124f95c4b545a365f56fd
SHA1

9853bdd87ad0946716bef43693919e2bec340a8f
SHA256

9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7
SHA512

950cc651e32a383903bc5ce4aaf64f247208cd528e85f7c955de8d369dcef0089a259e982402734690e449e297e9dda4af4402c8dd46d0633987ed95ef2f56cd
SSDEEP

1536:rzAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgE:r5+9wqY+mhhhmitqOD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	816	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1088	816	9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7_JC.exe	30
PID 816 wrote to memory of 1088	816	9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7_JC.exe	30
PID 816 wrote to memory of 1088	816	9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7_JC.exe	30
PID 816 wrote to memory of 1088	816	9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1056
  2⤵
  - Program crash
  PID:1088

memory/816-0-0x0000000000F50000-0x0000000000F84000-memory.dmp

Filesize
208KB

Download
memory/816-1-0x0000000074AF0000-0x00000000751DE000-memory.dmp

Filesize
6.9MB

Download
memory/816-2-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/816-3-0x0000000074AF0000-0x00000000751DE000-memory.dmp

Filesize
6.9MB

Download
memory/816-4-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download