3751dae5d0813f6ec2fcc253c65854ddad340be058b199f4eb0a540bbf878efe

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 04:03

Target

5399d7a2060eca17c4c1648fd6b09505.exe
Size

778KB
MD5

5399d7a2060eca17c4c1648fd6b09505
SHA1

e809cd291f45ad73bfc0ab35b3c23883f4f4eee9
SHA256

3751dae5d0813f6ec2fcc253c65854ddad340be058b199f4eb0a540bbf878efe
SHA512

18943b818a64357bf3aa3edfb8b5cdff36376b58c5d8180610127c60ed5b944d5d454d35fbed14de7ecad4c2dda794bdbff38054d1a865737223f371cd2a8b15
SSDEEP

12288:Xv4dLIwm2JMSzEM57yLx2j5xhvFTyTFiPVZqsXWryQW0jy8oWRfzp0KUu:XvAEw7t5HFmTANZqsXW2k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	1712	WerFault.exe	18

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	5399d7a2060eca17c4c1648fd6b09505.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2676	1712	5399d7a2060eca17c4c1648fd6b09505.exe	28
PID 1712 wrote to memory of 2676	1712	5399d7a2060eca17c4c1648fd6b09505.exe	28
PID 1712 wrote to memory of 2676	1712	5399d7a2060eca17c4c1648fd6b09505.exe	28
PID 1712 wrote to memory of 2676	1712	5399d7a2060eca17c4c1648fd6b09505.exe	28

C:\Users\Admin\AppData\Local\Temp\5399d7a2060eca17c4c1648fd6b09505.exe
"C:\Users\Admin\AppData\Local\Temp\5399d7a2060eca17c4c1648fd6b09505.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 1200
  2⤵
  - Program crash
  PID:2676

memory/1712-0-0x0000000000100000-0x00000000001C8000-memory.dmp

Filesize
800KB

Download
memory/1712-1-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/1712-2-0x0000000001FE0000-0x0000000002020000-memory.dmp

Filesize
256KB

Download
memory/1712-3-0x0000000000490000-0x0000000000498000-memory.dmp

Filesize
32KB

Download
memory/1712-4-0x00000000006D0000-0x000000000070C000-memory.dmp

Filesize
240KB

Download
memory/1712-5-0x0000000000720000-0x000000000074C000-memory.dmp

Filesize
176KB

Download
memory/1712-6-0x00000000021E0000-0x000000000222C000-memory.dmp

Filesize
304KB

Download
memory/1712-7-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/1712-8-0x0000000001FE0000-0x0000000002020000-memory.dmp

Filesize
256KB

Download