117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
14-11-2023 19:21

Target

117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1.exe
Size

166KB
MD5

dbe5e4bf83ddf3048c93002802ffcd44
SHA1

009206c44608b65747f35c200fc358c0ce2b0b69
SHA256

117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1
SHA512

ed325deeed7ce3a5a2fe4bfe14a04906f18c1b206373d54265dd2c8f2e93f239148fbafa798d65bc2e164bcdfe84df8dd0cdb506e4b322f39ee61961bff08915
SSDEEP

3072:aiprx9XUnRvmvKp12dyn6Dg6OT+2QluSWj4spv/u58RoGiPrYBh91Od:9XUnRvmvc2dyIgg2QluSW/2KRxE5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2212	2944	117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1.exe	28
PID 2944 wrote to memory of 2212	2944	117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1.exe	28
PID 2944 wrote to memory of 2212	2944	117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1.exe	28

C:\Users\Admin\AppData\Local\Temp\117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1.exe
"C:\Users\Admin\AppData\Local\Temp\117b27022b82a9689d2446aaefdfa9823729961a92cee9a9f068475566ebe5d1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2944 -s 1020
  2⤵
  PID:2212

memory/2944-0-0x00000000011F0000-0x000000000121E000-memory.dmp

Filesize
184KB

Download
memory/2944-1-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2944-2-0x000000001A660000-0x000000001A6E0000-memory.dmp

Filesize
512KB

Download
memory/2944-3-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download