1981b95b3a8ae3e9c22d1812de13614a9a0d89b2b8e65b05348d03445fde9d9e

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:35

Target

c718b85dc9b2c06b3c6bd995013c4bf8.exe
Size

9KB
MD5

c718b85dc9b2c06b3c6bd995013c4bf8
SHA1

710785bad0bc2b378bac03e3f34c22d21738fcfb
SHA256

1981b95b3a8ae3e9c22d1812de13614a9a0d89b2b8e65b05348d03445fde9d9e
SHA512

4a0a804f3d0c3603fec420422047dd1dec15d7f5b842acda17972c505406d8e7be8cf7b8af738ddcf7ccdfed3a02046df2116bf7c3bc7cab8e4913a167adcb36
SSDEEP

192:jBksu7EXVwVeneMZZ3093VnjdwCzq3lz0:1VwoneMIFnhwCG1z

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	c718b85dc9b2c06b3c6bd995013c4bf8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2744	2232	c718b85dc9b2c06b3c6bd995013c4bf8.exe	28
PID 2232 wrote to memory of 2744	2232	c718b85dc9b2c06b3c6bd995013c4bf8.exe	28
PID 2232 wrote to memory of 2744	2232	c718b85dc9b2c06b3c6bd995013c4bf8.exe	28

C:\Users\Admin\AppData\Local\Temp\c718b85dc9b2c06b3c6bd995013c4bf8.exe
"C:\Users\Admin\AppData\Local\Temp\c718b85dc9b2c06b3c6bd995013c4bf8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 896
  2⤵
  PID:2744

memory/2232-0-0x0000000000BD0000-0x0000000000BD8000-memory.dmp

Filesize
32KB

Download
memory/2232-1-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2232-2-0x000000001B750000-0x000000001B7D0000-memory.dmp

Filesize
512KB

Download
memory/2232-3-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2232-4-0x000000001B750000-0x000000001B7D0000-memory.dmp

Filesize
512KB

Download