d4a4bd4a4923a6f419952140aaa376c181e421e300b31855bdceb8e6860d5e9e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:44

Target

ded2c41bcd037db153503d5ee056a9e0.exe
Size

9KB
MD5

ded2c41bcd037db153503d5ee056a9e0
SHA1

f76ac2ae48f742d91bf8d8a6eaa124f75ebf6b55
SHA256

d4a4bd4a4923a6f419952140aaa376c181e421e300b31855bdceb8e6860d5e9e
SHA512

339b048f64a81ec7d00450a8d5cda28d763399f7782ff652a17cd79a45a4606ea681310d0006fcc65333f260c5367f5d5e85dda3931ddb8164d44eff1e77d2bb
SSDEEP

192:CBksuvPY82gQv5F4yteeMZZ3r93VnjdwCzi3v3rdZc:W82l4yteeMtFnhwCm/xZ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	ded2c41bcd037db153503d5ee056a9e0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2840	1852	ded2c41bcd037db153503d5ee056a9e0.exe	28
PID 1852 wrote to memory of 2840	1852	ded2c41bcd037db153503d5ee056a9e0.exe	28
PID 1852 wrote to memory of 2840	1852	ded2c41bcd037db153503d5ee056a9e0.exe	28

C:\Users\Admin\AppData\Local\Temp\ded2c41bcd037db153503d5ee056a9e0.exe
"C:\Users\Admin\AppData\Local\Temp\ded2c41bcd037db153503d5ee056a9e0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1852 -s 896
  2⤵
  PID:2840

memory/1852-0-0x0000000001100000-0x0000000001108000-memory.dmp

Filesize
32KB

Download
memory/1852-1-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

Filesize
9.9MB

Download
memory/1852-2-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download
memory/1852-3-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

Filesize
9.9MB

Download
memory/1852-4-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download