186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22-09-2023 05:38

Target

186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe
Size

6.3MB
MD5

700f503afec13f4f8559526bc28701cd
SHA1

26f552781ef04626792579013161ca825a37606c
SHA256

186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b
SHA512

bb281d1390c228664d8e48e7f4363f0efd9f4347ee854eaca705bb2e52f7e05fb83408b35ee15680f3a88695349ff79f1c32b691a62d1666a9d4bda58a8e6367
SSDEEP

98304:L7qFjaQ3ZQl9oLCqq5iyka35Nh4e/i43s0JBAUZLN:QeM0iPa35N+e/i4c0JVp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	2148	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2148	186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe
2148	186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2580	2148	186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe	28
PID 2148 wrote to memory of 2580	2148	186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe	28
PID 2148 wrote to memory of 2580	2148	186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe	28
PID 2148 wrote to memory of 2580	2148	186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe	28

C:\Users\Admin\AppData\Local\Temp\186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe
"C:\Users\Admin\AppData\Local\Temp\186bb2a57a1ccce71d61413a72589890c7c9000058c93d9cc660ab32b24cb91b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 404
  2⤵
  - Program crash
  PID:2580

memory/2148-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2148-5-0x0000000002300000-0x0000000002341000-memory.dmp

Filesize
260KB

Download