c6643f3a42c75b2c3b774c9f07bafa978b8ac79a4620a380067a3b4fab7b85a4

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
30-10-2023 14:30

Target

Mybxbutrghm.exe
Size

36KB
MD5

e3943355389d2af1de3dea068e7ca43e
SHA1

da4c486cdc0f0329f2e2969d9df698b91599d88c
SHA256

07f7c6e2ca27e05f3e3924f8b32cf92de6493ec4b7657beddc3243d7ae49cca5
SHA512

6cfb9713e4227189cf6401143b2f107bf40ccae5e227cb2e460fa82007297c510eaff72e6b7b599d762672d9146587770c2aeebfba80eba488c9167d29d61e7e
SSDEEP

768:RZOZ3fnxNzV5j1DLas3RqtGx+roLYP+k5:RZifXjj1DLasBC+k5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Mybxbutrghm.exe

description pid process

Token: SeDebugPrivilege 2516 Mybxbutrghm.exe

description	pid	process
Token: SeDebugPrivilege	2516	Mybxbutrghm.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Mybxbutrghm.exe

description	pid	process	target process
PID 2516 wrote to memory of 2816	2516	Mybxbutrghm.exe	WerFault.exe
PID 2516 wrote to memory of 2816	2516	Mybxbutrghm.exe	WerFault.exe
PID 2516 wrote to memory of 2816	2516	Mybxbutrghm.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2516 -s 1176
2⤵
PID:2816

memory/2516-0-0x0000000000130000-0x0000000000140000-memory.dmp

Filesize
64KB

Download
memory/2516-1-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2516-2-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/2516-3-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2516-4-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download