cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 07:38

Target

cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9.exe
Size

1.3MB
MD5

e9c68b391e59c884799737a0c94e13f2
SHA1

d47af52d763d275589a6358074ba344f0aec1221
SHA256

cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9
SHA512

121370e11896ec7b30d4aa0d470400af788a52c923f8d96ffdfcfa78d3229161d75c63dc3f6567b34314f47bd84b321a7428872ccef9ce8ccd8a2f90524a163f
SSDEEP

24576:TdE0L4Isngy5Z1hLercU0oLMvSr7WbJ7rDS0slQctBZy:vL+nb73LpUJWV7CpzU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	2196	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2620	2196	cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9.exe	28
PID 2196 wrote to memory of 2620	2196	cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9.exe	28
PID 2196 wrote to memory of 2620	2196	cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9.exe	28

C:\Users\Admin\AppData\Local\Temp\cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9.exe
"C:\Users\Admin\AppData\Local\Temp\cd3ed5855569c916f25884fbae87e55db08f61ed8de4b4f6a405cb139f42a3d9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2196 -s 832
  2⤵
  - Program crash
  PID:2620

memory/2196-0-0x0000000000450000-0x0000000000482000-memory.dmp

Filesize
200KB

Download
memory/2196-1-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/2196-2-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/2196-3-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/2196-4-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/2196-8-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/2196-9-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download