b76aed181fc4d9590a9d4aefb7a00a5a13abadf2dfc7a3953985b9cc039a7378

Analysis

max time kernel
41s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 14:15

Target

b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe
Size

63KB
MD5

5c2bde97438d98edb3dd2a755aa12339
SHA1

6cd4a3bab1d639d43cb687c5f3a31da96ed6a981
SHA256

b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce
SHA512

05b09f329c5262884ffb1c26881548cb0c054786c8ae71728e5642ae1b1eb4ef09dbc197ae67f7f5a4ba16b331a12ae5c0ee5c74fcc6b3ae0f38c067742ea7e6
SSDEEP

768:ROwlvI5QKedEGn9qeNXalsFHp1fDaAL7X07dsYmTCknHq4OXxAiTqF6:ROwijynylifDaAX07dsYcnnon

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1048 1964 WerFault.exe b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe

pid process

1964 b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe

description pid process

Token: SeTakeOwnershipPrivilege 1964 b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe

pid	pid_target	process	target process
1048	1964	WerFault.exe	b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe

pid	process
1964	b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1964	b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe

description	pid	process	target process
PID 1964 wrote to memory of 1048	1964	b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe	WerFault.exe
PID 1964 wrote to memory of 1048	1964	b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe	WerFault.exe
PID 1964 wrote to memory of 1048	1964	b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe	WerFault.exe
PID 1964 wrote to memory of 1048	1964	b99c904be547228d5a2db0522243a158a3bc0c6cfc901012944457daada602ce.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 284
2⤵
- Program crash
PID:1048

memory/1964-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1964-3-0x0000000077230000-0x0000000077231000-memory.dmp

Filesize
4KB

Download
memory/1964-5-0x0000000001F60000-0x0000000001F6B000-memory.dmp

Filesize
44KB

Download
memory/1964-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1964-7-0x0000000001F60000-0x0000000001F6B000-memory.dmp

Filesize
44KB

Download