00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 08:53

Target

00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe
Size

674KB
MD5

b932dee3c7fbc1987f841bb32e073d2d
SHA1

887358e6664ae88e9536b42b13019d0a94d89e22
SHA256

00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159
SHA512

2ec17eb0e9842514f6017f91f96d1c045c59ad519b71cb3f7f060ff721342119ee041601af92a1dc776e8f98b93de9e7b7a9c1cce08f50b92df8e0973a93fb3a
SSDEEP

12288:ygo+gg4nKbCPCceCBDjX+VvfDKha7Ut5e/dkCnVj53XPDT:yogg4nKb8CmjXwO5e/dkQ3/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	3020	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3020	00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2640	3020	00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe	30
PID 3020 wrote to memory of 2640	3020	00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe	30
PID 3020 wrote to memory of 2640	3020	00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe	30
PID 3020 wrote to memory of 2640	3020	00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe	30

C:\Users\Admin\AppData\Local\Temp\00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe
"C:\Users\Admin\AppData\Local\Temp\00de59b47743f85e326cdbe02d21392930a6ca7a3c697c5c0ab89fedf1a63159.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 1208
  2⤵
  - Program crash
  PID:2640

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:2196

memory/3020-0-0x0000000001270000-0x0000000001320000-memory.dmp

Filesize
704KB

Download
memory/3020-1-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/3020-5-0x0000000006370000-0x00000000063B0000-memory.dmp

Filesize
256KB

Download
memory/3020-6-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/3020-7-0x0000000006370000-0x00000000063B0000-memory.dmp

Filesize
256KB

Download