b5ce197bb5107e62ef21561317cf31b700461e4d18222e4fb585446870f37a51

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:29

Target

a3eafacd45c0891ded9428d0f015aa94.exe
Size

9KB
MD5

a3eafacd45c0891ded9428d0f015aa94
SHA1

d989031db1baadd25ea62f857d61ddcc339756bc
SHA256

b5ce197bb5107e62ef21561317cf31b700461e4d18222e4fb585446870f37a51
SHA512

6cde4db605d261e6b056b2ebe4104eae3d49db0b1d8be5112e09d84c4b3d09a3b48e2161415fbaea7ffe0a3eab8a544d6448b73e8fc3a462f455d039e5c05c16
SSDEEP

192:UBksuDzHNQ8HYeMZZ3E93VnjdwqzN3mCG/es:fHpYeMIFnhwqh2Cee

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	a3eafacd45c0891ded9428d0f015aa94.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2724	2204	a3eafacd45c0891ded9428d0f015aa94.exe	28
PID 2204 wrote to memory of 2724	2204	a3eafacd45c0891ded9428d0f015aa94.exe	28
PID 2204 wrote to memory of 2724	2204	a3eafacd45c0891ded9428d0f015aa94.exe	28

C:\Users\Admin\AppData\Local\Temp\a3eafacd45c0891ded9428d0f015aa94.exe
"C:\Users\Admin\AppData\Local\Temp\a3eafacd45c0891ded9428d0f015aa94.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2204 -s 900
  2⤵
  PID:2724

memory/2204-0-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download
memory/2204-1-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2204-2-0x000000001B210000-0x000000001B290000-memory.dmp

Filesize
512KB

Download
memory/2204-3-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2204-4-0x000000001B210000-0x000000001B290000-memory.dmp

Filesize
512KB

Download