090aa99d794ed899cb5f21ce2680b5aecd06bba5d78b6054403d3420cff53577

Analysis

max time kernel
117s
max time network
145s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 23:21

Target

566b6c754863b95983a0e6ed33bcb035.exe
Size

32.2MB
MD5

566b6c754863b95983a0e6ed33bcb035
SHA1

86a21825e9b155bbf10503ae6bc72f197a100d4e
SHA256

090aa99d794ed899cb5f21ce2680b5aecd06bba5d78b6054403d3420cff53577
SHA512

392596753d86f66a4e691e87b4c16133914525e34e0550bc84f98610c99154ab9e2e3b5d6a8fe423bc08a54ef4212d97b94f90638760291f6ad77f1d721baac1
SSDEEP

393216:6bekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9y:pZn/G4Gqk1cWe2iTVCMue3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	1180	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	566b6c754863b95983a0e6ed33bcb035.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2660	1180	566b6c754863b95983a0e6ed33bcb035.exe	28
PID 1180 wrote to memory of 2660	1180	566b6c754863b95983a0e6ed33bcb035.exe	28
PID 1180 wrote to memory of 2660	1180	566b6c754863b95983a0e6ed33bcb035.exe	28
PID 1180 wrote to memory of 2660	1180	566b6c754863b95983a0e6ed33bcb035.exe	28

C:\Users\Admin\AppData\Local\Temp\566b6c754863b95983a0e6ed33bcb035.exe
"C:\Users\Admin\AppData\Local\Temp\566b6c754863b95983a0e6ed33bcb035.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 1092
  2⤵
  - Program crash
  PID:2660

memory/1180-0-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-1-0x0000000000EC0000-0x0000000002F02000-memory.dmp

Filesize
32.3MB

Download
memory/1180-2-0x0000000006AE0000-0x0000000006B20000-memory.dmp

Filesize
256KB

Download
memory/1180-3-0x0000000006EB0000-0x0000000007072000-memory.dmp

Filesize
1.8MB

Download
memory/1180-5-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-6-0x0000000006AE0000-0x0000000006B20000-memory.dmp

Filesize
256KB

Download