c73c97888e824a509cc8dbd8d01e61481797ac4eb13f3f3864d6d795dca8d234

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18/09/2023, 04:09

Target

Hamedal AW-A20承认书-中性包材承认书/Hamedal AW-A20承认书-中性包材承认书.exe
Size

635KB
MD5

8516a1d1811b8e94126f8f0747f66410
SHA1

772ba9f06df3ab61c9e87144a69bb96c7f8a4ec0
SHA256

f6eab3af398ca3ebaef6fbcb497628b18a73074d7f7dccd9a5db5ec86c0d48ed
SHA512

66c9a3f25f2e1426ad440a0f927447e3e2cf82d5442bd49ce8391e904373e6b646c7d2b09c460903175aa82bccac396e740ec5e4d8d69ba0d2218907835015a0
SSDEEP

12288:/yEYyVFSN4ChS6Sal/AFlFnOAxhWaQ73fib5eyyRiOzSYSIVAy:aV+FY0k/AHFn1xPQudepgOmYj3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	1280	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1280	Hamedal AW-A20承认书-中性包材承认书.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	Hamedal AW-A20承认书-中性包材承认书.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2636	1280	Hamedal AW-A20承认书-中性包材承认书.exe	30
PID 1280 wrote to memory of 2636	1280	Hamedal AW-A20承认书-中性包材承认书.exe	30
PID 1280 wrote to memory of 2636	1280	Hamedal AW-A20承认书-中性包材承认书.exe	30
PID 1280 wrote to memory of 2636	1280	Hamedal AW-A20承认书-中性包材承认书.exe	30

C:\Users\Admin\AppData\Local\Temp\Hamedal AW-A20承认书-中性包材承认书\Hamedal AW-A20承认书-中性包材承认书.exe
"C:\Users\Admin\AppData\Local\Temp\Hamedal AW-A20承认书-中性包材承认书\Hamedal AW-A20承认书-中性包材承认书.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 788
  2⤵
  - Program crash
  PID:2636

memory/1280-0-0x0000000000A80000-0x0000000000B24000-memory.dmp

Filesize
656KB

Download
memory/1280-1-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/1280-2-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/1280-3-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/1280-4-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/1280-5-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/1280-6-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/1280-7-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1280-8-0x0000000005480000-0x00000000054FA000-memory.dmp

Filesize
488KB

Download