01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 08:51

Target

01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe
Size

598KB
MD5

b12ac0b81f6e4d22e10dc9a915edf225
SHA1

2bb0e9bc8b7e96bbb0c15ce25946d5beff4c0f70
SHA256

01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5
SHA512

3de1e355d46d400ebf5a7bb66463bebcc79e8392e62ebd8427c294c125d5c8df78c9ce88a651645c02a738aa81cf6db73d63b5dbe8c9d979bf79d5198c0e9a05
SSDEEP

12288:bRgGYEj+PEX9iDqb+bMtclGnt9XP23K404FUuVvSP:bRkU+PGRbYMKlGt9Xei

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	3028	WerFault.exe	12

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3028	01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2652	3028	01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe	30
PID 3028 wrote to memory of 2652	3028	01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe	30
PID 3028 wrote to memory of 2652	3028	01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe	30
PID 3028 wrote to memory of 2652	3028	01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe	30

C:\Users\Admin\AppData\Local\Temp\01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe
"C:\Users\Admin\AppData\Local\Temp\01111c00ae573f1e443a8af1ac799cdc49762a70546286d11254e3bbb64bffe5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 1176
  2⤵
  - Program crash
  PID:2652

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:2632

memory/3028-0-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-1-0x0000000000AB0000-0x0000000000B4A000-memory.dmp

Filesize
616KB

Download
memory/3028-2-0x0000000001F50000-0x0000000001FA6000-memory.dmp

Filesize
344KB

Download
memory/3028-6-0x0000000004960000-0x00000000049A0000-memory.dmp

Filesize
256KB

Download
memory/3028-7-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-8-0x0000000004960000-0x00000000049A0000-memory.dmp

Filesize
256KB

Download