82188fb69fb8920675d6c185560385c2526219f9fdfd0220490cd7ebb2c57697

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 08:00

Target

PI-20230724113328527-BKD 3827660 PI.scr.exe
Size

197KB
MD5

50bd6bea90ec50408ada97418a8a5656
SHA1

4d32553b4f9fda2bc979d925b49c5fdc324c223e
SHA256

82188fb69fb8920675d6c185560385c2526219f9fdfd0220490cd7ebb2c57697
SHA512

c08a6092d4d9b10a8a285da680147a331040c666bb893b36368ea7de36ea7cc4996d31dafa427a7d045702336b035110018c5cb94974831e4cd2b5edb105a9a4
SSDEEP

768:WbsV+4FwTBpqoOkAIP8co9kWFpCGUobAAHCOofRpESUJXtAhVm13jWtSHPWcVaYb:0E+4wTBpqINGdFhU6AACOofoS4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2152	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	PI-20230724113328527-BKD 3827660 PI.scr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2644	2152	PI-20230724113328527-BKD 3827660 PI.scr.exe	28
PID 2152 wrote to memory of 2644	2152	PI-20230724113328527-BKD 3827660 PI.scr.exe	28
PID 2152 wrote to memory of 2644	2152	PI-20230724113328527-BKD 3827660 PI.scr.exe	28
PID 2152 wrote to memory of 2644	2152	PI-20230724113328527-BKD 3827660 PI.scr.exe	28

C:\Users\Admin\AppData\Local\Temp\PI-20230724113328527-BKD 3827660 PI.scr.exe
"C:\Users\Admin\AppData\Local\Temp\PI-20230724113328527-BKD 3827660 PI.scr.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1248
  2⤵
  - Program crash
  PID:2644

memory/2152-0-0x00000000011A0000-0x00000000011D8000-memory.dmp

Filesize
224KB

Download
memory/2152-1-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2152-2-0x0000000004770000-0x00000000047B0000-memory.dmp

Filesize
256KB

Download
memory/2152-3-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download