fac373a26a5f0458890deea7bc93d6ea6e769eeb6440d56c5adf9f3da8838c90

Resubmissions

30/10/2023, 08:51

30/10/2023, 08:48

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
30/10/2023, 08:48

Target

Yjntdre.exe
Size

26KB
MD5

f02100eb5f3140c05def18e397fd6175
SHA1

dabcc934eec02af1b9faaed6e911791272c1a089
SHA256

fac373a26a5f0458890deea7bc93d6ea6e769eeb6440d56c5adf9f3da8838c90
SHA512

8825f91409483d0ea8113ddb37bb7115c381fc2d5e5d2135b71ed04779714fd8f6f9ac9bb114c88bccc5c5efbb184de959d0af03aeb0a8faf06ec298154e493f
SSDEEP

384:5PQ9Uh8DHZ7+tCO0VobNPnbn+b/AeH9F9wGjEnAtNCSGFqUD:duZtoZPbn+rLXiiEnuCLFqUD

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	Yjntdre.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2644	2580	Yjntdre.exe	28
PID 2580 wrote to memory of 2644	2580	Yjntdre.exe	28
PID 2580 wrote to memory of 2644	2580	Yjntdre.exe	28

C:\Users\Admin\AppData\Local\Temp\Yjntdre.exe
"C:\Users\Admin\AppData\Local\Temp\Yjntdre.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2580 -s 1168
  2⤵
  PID:2644

memory/2580-0-0x0000000001190000-0x000000000119C000-memory.dmp

Filesize
48KB

Download
memory/2580-1-0x000007FEF5670000-0x000007FEF605C000-memory.dmp

Filesize
9.9MB

Download
memory/2580-2-0x000000001AE90000-0x000000001AF10000-memory.dmp

Filesize
512KB

Download
memory/2580-3-0x000007FEF5670000-0x000007FEF605C000-memory.dmp

Filesize
9.9MB

Download
memory/2580-4-0x000000001AE90000-0x000000001AF10000-memory.dmp

Filesize
512KB

Download