801fc45655fe2df6a9dc474991f35cc5f53e9d0f032ab01187fb12fa6aee7623

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:03

Target

b54487f2d4f5764d598bc075e4127647.exe
Size

9KB
MD5

b54487f2d4f5764d598bc075e4127647
SHA1

94b20d75b59941aa312e1074aa57cf50db3d88d0
SHA256

801fc45655fe2df6a9dc474991f35cc5f53e9d0f032ab01187fb12fa6aee7623
SHA512

b547b78adb69cd86a2218ba9a6a111f7a6af858d1e51abb13e44b663ed68cb077eed8eaec1827cb2013038dccc41be44adf9e928eb0f5cf02b0bd78125a91dd2
SSDEEP

192:FBksun9MuIdPeMZZ3D93Vnjdwqzk3uLO:ulsPeMFFnhwqoeL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	b54487f2d4f5764d598bc075e4127647.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2712	2080	b54487f2d4f5764d598bc075e4127647.exe	28
PID 2080 wrote to memory of 2712	2080	b54487f2d4f5764d598bc075e4127647.exe	28
PID 2080 wrote to memory of 2712	2080	b54487f2d4f5764d598bc075e4127647.exe	28

C:\Users\Admin\AppData\Local\Temp\b54487f2d4f5764d598bc075e4127647.exe
"C:\Users\Admin\AppData\Local\Temp\b54487f2d4f5764d598bc075e4127647.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 904
  2⤵
  PID:2712

memory/2080-0-0x0000000000D60000-0x0000000000D68000-memory.dmp

Filesize
32KB

Download
memory/2080-1-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/2080-2-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download
memory/2080-3-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/2080-4-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download