137a42b44456cda97e6b8a6431815e4e3fd39d3b7d9db9305d8d46ca6d6e4c84

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 13:46

Target

ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe
Size

3.5MB
MD5

ab62c9ce9dac90bec9065e017b6bd47e
SHA1

7bdc88571d1f6effd9ce7fba04606cc9e77f0a04
SHA256

ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a
SHA512

3bd07aec2f3780723453ba80df1b196a80a512cea7d28f39139e3cc6885095d0ba7d11a313e29a8cc6d14fa1d3a03253dc1e233c3d605ca48fedd805daf0d6ef
SSDEEP

98304:glna//g2AB8YwYpovSA+aECKN9qJY4OS:gsYZ8TvJ+tNal

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	1348	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1348	ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe
Token: SeIncBasePriorityPrivilege	1348	ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2956	1348	ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe	28
PID 1348 wrote to memory of 2956	1348	ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe	28
PID 1348 wrote to memory of 2956	1348	ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe	28
PID 1348 wrote to memory of 2956	1348	ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe	28

C:\Users\Admin\AppData\Local\Temp\ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe
"C:\Users\Admin\AppData\Local\Temp\ccb30dfda02439a5bb8201f2322e9ad9412e11bf8718ca3677a50e59f85c6a9a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 420
  2⤵
  - Program crash
  PID:2956

memory/1348-0-0x0000000000400000-0x0000000001146000-memory.dmp

Filesize
13.3MB

Download
memory/1348-1-0x0000000000400000-0x0000000001146000-memory.dmp

Filesize
13.3MB

Download
memory/1348-2-0x0000000000400000-0x0000000001146000-memory.dmp

Filesize
13.3MB

Download
memory/1348-3-0x0000000000400000-0x0000000001146000-memory.dmp

Filesize
13.3MB

Download
memory/1348-4-0x0000000000400000-0x0000000001146000-memory.dmp

Filesize
13.3MB

Download
memory/1348-5-0x0000000000400000-0x0000000001146000-memory.dmp

Filesize
13.3MB

Download
memory/1348-6-0x0000000000400000-0x0000000001146000-memory.dmp

Filesize
13.3MB

Download
memory/1348-7-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1348-9-0x0000000000400000-0x0000000001146000-memory.dmp

Filesize
13.3MB

Download
memory/1348-10-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download