3fd1ab42c0b3f55ad13db28408b7b0c62918de655caaa8dfc45dbd95ad05a3fd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 13:56

Target

b285b5bdfb535f65a8b27f119ad56f1e.exe
Size

9KB
MD5

b285b5bdfb535f65a8b27f119ad56f1e
SHA1

62eced9b6d77efe4c04cdc59e427dc7e00ac2e46
SHA256

3fd1ab42c0b3f55ad13db28408b7b0c62918de655caaa8dfc45dbd95ad05a3fd
SHA512

f9a41d500ec6226c9697b847a50284240278750926c58050cc25473802bb4cd364772a171cc77d138ca41cde06f8da86d6c5d60b8ac0560b0b0357a666e2ed90
SSDEEP

192:kBksu/EXVwVvLeMZZ3E93VnjdwCzH3FY7HFG:sVwpLeMgFnhwCzVAF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	b285b5bdfb535f65a8b27f119ad56f1e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2700	2652	b285b5bdfb535f65a8b27f119ad56f1e.exe	28
PID 2652 wrote to memory of 2700	2652	b285b5bdfb535f65a8b27f119ad56f1e.exe	28
PID 2652 wrote to memory of 2700	2652	b285b5bdfb535f65a8b27f119ad56f1e.exe	28

C:\Users\Admin\AppData\Local\Temp\b285b5bdfb535f65a8b27f119ad56f1e.exe
"C:\Users\Admin\AppData\Local\Temp\b285b5bdfb535f65a8b27f119ad56f1e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2652 -s 892
  2⤵
  PID:2700

memory/2652-0-0x0000000000110000-0x0000000000118000-memory.dmp

Filesize
32KB

Download
memory/2652-1-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

Filesize
9.9MB

Download
memory/2652-2-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download
memory/2652-3-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

Filesize
9.9MB

Download
memory/2652-4-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download