79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
25-09-2023 12:00

Target

79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1.exe
Size

1.3MB
MD5

558e933fb43fabf832734fcb3e4031bb
SHA1

2dee002beaf85442d4b1738c0bfdd033de066ebb
SHA256

79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1
SHA512

63f8b492bcee9cbfd6bb3b4608f597bef0b66820b74a1240ebf9fd968aba0c64691677230ef052b0e48bf280505fb29560321b72d8e3b6a14dab665a73069747
SSDEEP

24576:3OpSEmnjglsX4yy471UA+ITg1gC0EOI88TiSDS59d1vSbJ7:e2n0qX4y7dVc1qEO0Tc9SV7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1408	79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2596	1408	79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1.exe	28
PID 1408 wrote to memory of 2596	1408	79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1.exe	28
PID 1408 wrote to memory of 2596	1408	79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1.exe	28

C:\Users\Admin\AppData\Local\Temp\79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1.exe
"C:\Users\Admin\AppData\Local\Temp\79c251c4440edcb58f71c36ec9da4bc7a09f957a18906aecff0935a19e6329b1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1408 -s 1220
  2⤵
  PID:2596

memory/1408-0-0x0000000001CB0000-0x0000000001CEE000-memory.dmp

Filesize
248KB

Download
memory/1408-1-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

Filesize
9.9MB

Download
memory/1408-2-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/1408-3-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/1408-4-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/1408-5-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/1408-9-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/1408-10-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

Filesize
9.9MB

Download
memory/1408-11-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download