06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231201-en
resource tags

arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
submitted
06-12-2023 16:44

Target

06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6.exe
Size

1.8MB
MD5

209ce9560ce534608415937ddc323a9c
SHA1

942b4c3123ca6bb9ecfc479bfb26a3768d3fc289
SHA256

06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6
SHA512

08272d48625a554fb23c7c1d17e1da8630aeb9757499dd0721d5243e95b8e515147de61184e33731f227d20ece80d7a11e378c6c06d42b8c076d03ff7a6adf0c
SSDEEP

24576:c+NXDnJ3U1BtHrVRtm3Aqa7HYdxTQt7zkpbJ7vDSKuSbksRlv1Munu155JPG:1J3oTLV+3zNQuV74SBRlvx8558

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2764	2152	06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6.exe	28
PID 2152 wrote to memory of 2764	2152	06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6.exe	28
PID 2152 wrote to memory of 2764	2152	06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6.exe	28

C:\Users\Admin\AppData\Local\Temp\06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6.exe
"C:\Users\Admin\AppData\Local\Temp\06b65bd9da2ca1cc93132edf0bc6f055ecd1cd6948140500d987da117358c0f6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 828
  2⤵
  PID:2764

memory/2152-0-0x000000013FE80000-0x0000000140105000-memory.dmp

Filesize
2.5MB

Download
memory/2152-1-0x000000013FE80000-0x0000000140105000-memory.dmp

Filesize
2.5MB

Download
memory/2152-3-0x0000000002EC0000-0x0000000002F40000-memory.dmp

Filesize
512KB

Download
memory/2152-2-0x0000000000440000-0x000000000047E000-memory.dmp

Filesize
248KB

Download
memory/2152-4-0x000007FEF5ED0000-0x000007FEF68BC000-memory.dmp

Filesize
9.9MB

Download
memory/2152-5-0x0000000002EC0000-0x0000000002F40000-memory.dmp

Filesize
512KB

Download
memory/2152-6-0x0000000002EC0000-0x0000000002F40000-memory.dmp

Filesize
512KB

Download
memory/2152-7-0x0000000002EC0000-0x0000000002F40000-memory.dmp

Filesize
512KB

Download
memory/2152-12-0x0000000002EC0000-0x0000000002F40000-memory.dmp

Filesize
512KB

Download
memory/2152-13-0x000000013FE80000-0x0000000140105000-memory.dmp

Filesize
2.5MB

Download
memory/2152-14-0x0000000002EC0000-0x0000000002F40000-memory.dmp

Filesize
512KB

Download
memory/2152-15-0x000007FEF5ED0000-0x000007FEF68BC000-memory.dmp

Filesize
9.9MB

Download
memory/2152-16-0x0000000002EC0000-0x0000000002F40000-memory.dmp

Filesize
512KB

Download
memory/2152-17-0x0000000002EC0000-0x0000000002F40000-memory.dmp

Filesize
512KB

Download