4eafcbc5ce44520fa15d6cb4419e2e946bf3588030abf62df6182924326bf1f4

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 11:30

Target

14892d2315b8ab64d4da58c95550916f.exe
Size

9KB
MD5

14892d2315b8ab64d4da58c95550916f
SHA1

be931ca42fab0f727e9fc4fe9be1aa204588e47f
SHA256

4eafcbc5ce44520fa15d6cb4419e2e946bf3588030abf62df6182924326bf1f4
SHA512

2f508b7756532521786907c1fe94530779677d49a2c23ffae825363f55f9ac989f82a299cda3dafa12575ff4ef1d8ff31f071570ed34d526241ee524567e502a
SSDEEP

192:sOpBksuHrN3y+6YeMZZ3L93VnjdwCzL3L5dDN:srZcYeM9FnhwC3b5dD

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	14892d2315b8ab64d4da58c95550916f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2724	2852	14892d2315b8ab64d4da58c95550916f.exe	28
PID 2852 wrote to memory of 2724	2852	14892d2315b8ab64d4da58c95550916f.exe	28
PID 2852 wrote to memory of 2724	2852	14892d2315b8ab64d4da58c95550916f.exe	28

C:\Users\Admin\AppData\Local\Temp\14892d2315b8ab64d4da58c95550916f.exe
"C:\Users\Admin\AppData\Local\Temp\14892d2315b8ab64d4da58c95550916f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2852 -s 900
  2⤵
  PID:2724

memory/2852-0-0x0000000000F50000-0x0000000000F58000-memory.dmp

Filesize
32KB

Download
memory/2852-1-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-2-0x000000001B050000-0x000000001B0D0000-memory.dmp

Filesize
512KB

Download
memory/2852-3-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-4-0x000000001B050000-0x000000001B0D0000-memory.dmp

Filesize
512KB

Download