a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 08:53

Target

a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe
Size

1.0MB
MD5

340aaab1d32bc2409278b782e96f713e
SHA1

d92e26033ff43ce824e26931456b51919da37da0
SHA256

a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e
SHA512

c6d1d01defcde6bb5f14b1237a5bf70977878e9cad105dfca054789394670dc15c87870204d4476726d85836b0866e22af74807ad06148e7cc1c52c1f27034bc
SSDEEP

12288:zxByBgpGoPGJew8t2HQNA+2eD/jwbn4c6Kha7Ut5e/dkCnVj53XPDljXVvlG:LyB309i8n7jw9UO5e/dkQ3w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	2812	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2812	a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2300	2812	a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe	30
PID 2812 wrote to memory of 2300	2812	a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe	30
PID 2812 wrote to memory of 2300	2812	a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe	30
PID 2812 wrote to memory of 2300	2812	a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe	30

C:\Users\Admin\AppData\Local\Temp\a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe
"C:\Users\Admin\AppData\Local\Temp\a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 1200
  2⤵
  - Program crash
  PID:2300

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:2628

memory/2812-0-0x0000000000190000-0x000000000029C000-memory.dmp

Filesize
1.0MB

Download
memory/2812-1-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2812-5-0x0000000006080000-0x00000000060C0000-memory.dmp

Filesize
256KB

Download
memory/2812-6-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2812-7-0x0000000006080000-0x00000000060C0000-memory.dmp

Filesize
256KB

Download