9d93e4aad3650b56a2c27d5a03c091e5ecb052f1bdb2384582564f59d36244c3

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:20

Target

8ba0ace4df2b83b7f4ec15b3539c2caa.exe
Size

9KB
MD5

8ba0ace4df2b83b7f4ec15b3539c2caa
SHA1

f32e9d216c3dd034eb8a86b424d435399007735d
SHA256

9d93e4aad3650b56a2c27d5a03c091e5ecb052f1bdb2384582564f59d36244c3
SHA512

701e1d90791974d79ec5ffb8ebd7723f8fb23cce38580621f14be41e95a8d08cadf331b49c140604c6bbc6c078edf67d37b84013714fbd7b42da402622ca2ad6
SSDEEP

192:GBksuPEXVwVuIeMZZ39D93VnjdwCzD3f9DF:mVwEIeMTFnhwCvP9

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	8ba0ace4df2b83b7f4ec15b3539c2caa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2332	2448	8ba0ace4df2b83b7f4ec15b3539c2caa.exe	28
PID 2448 wrote to memory of 2332	2448	8ba0ace4df2b83b7f4ec15b3539c2caa.exe	28
PID 2448 wrote to memory of 2332	2448	8ba0ace4df2b83b7f4ec15b3539c2caa.exe	28

C:\Users\Admin\AppData\Local\Temp\8ba0ace4df2b83b7f4ec15b3539c2caa.exe
"C:\Users\Admin\AppData\Local\Temp\8ba0ace4df2b83b7f4ec15b3539c2caa.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2448 -s 900
  2⤵
  PID:2332

memory/2448-0-0x0000000000060000-0x0000000000068000-memory.dmp

Filesize
32KB

Download
memory/2448-1-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2448-2-0x0000000000510000-0x0000000000590000-memory.dmp

Filesize
512KB

Download
memory/2448-3-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2448-4-0x0000000000510000-0x0000000000590000-memory.dmp

Filesize
512KB

Download