92dfae5c4117871e7dd153692389eda73da26eae3d12df3de551964cf1f60dc6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:40

Target

a958448ebe8889e0608aad280570bf06.exe
Size

9KB
MD5

a958448ebe8889e0608aad280570bf06
SHA1

9b39152c47a62cc8974b4a63eb2a922a22f0ba5e
SHA256

92dfae5c4117871e7dd153692389eda73da26eae3d12df3de551964cf1f60dc6
SHA512

dbce45149a54e5e807c85da639f55b33d87d103ab27a164b99a1849feda5a5c18c199cde4346a7e83f439118e29ad44da3dd426586db4e0c34e2ed36c0d31b34
SSDEEP

192:cBksurzHNQKYeMZZ3M93VnjdwqzH3u/NS:fHlYeMoFnhwqze/N

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	a958448ebe8889e0608aad280570bf06.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2360	2232	a958448ebe8889e0608aad280570bf06.exe	28
PID 2232 wrote to memory of 2360	2232	a958448ebe8889e0608aad280570bf06.exe	28
PID 2232 wrote to memory of 2360	2232	a958448ebe8889e0608aad280570bf06.exe	28

C:\Users\Admin\AppData\Local\Temp\a958448ebe8889e0608aad280570bf06.exe
"C:\Users\Admin\AppData\Local\Temp\a958448ebe8889e0608aad280570bf06.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 896
  2⤵
  PID:2360

memory/2232-0-0x0000000000BE0000-0x0000000000BE8000-memory.dmp

Filesize
32KB

Download
memory/2232-1-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-2-0x000000001B240000-0x000000001B2C0000-memory.dmp

Filesize
512KB

Download
memory/2232-3-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-4-0x000000001B240000-0x000000001B2C0000-memory.dmp

Filesize
512KB

Download