25f9d0086506b190c5d0dda903814365ae28d066a7bcefe107f05c526d61b3bf

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:57

Target

d08785513eb6595e54977381fb0a18aa.exe
Size

9KB
MD5

d08785513eb6595e54977381fb0a18aa
SHA1

2f95a07ac692eb90e6ead4865c3ded723fc05af3
SHA256

25f9d0086506b190c5d0dda903814365ae28d066a7bcefe107f05c526d61b3bf
SHA512

09f417bb40b4f769607088c4d430eef357cb143f8be1e157c0d294e3eb01e52d88947a04a0ed3810ee9f9226765557c5ffe061edf3db57cf2f8e11df01232ffd
SSDEEP

192:qBksuL9MuIZ0eMZZ3K93VnjdwqzH3HbSB:7lA0eMOFnhwqrrS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	d08785513eb6595e54977381fb0a18aa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2864	2232	d08785513eb6595e54977381fb0a18aa.exe	28
PID 2232 wrote to memory of 2864	2232	d08785513eb6595e54977381fb0a18aa.exe	28
PID 2232 wrote to memory of 2864	2232	d08785513eb6595e54977381fb0a18aa.exe	28

C:\Users\Admin\AppData\Local\Temp\d08785513eb6595e54977381fb0a18aa.exe
"C:\Users\Admin\AppData\Local\Temp\d08785513eb6595e54977381fb0a18aa.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 896
  2⤵
  PID:2864

memory/2232-0-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

Filesize
32KB

Download
memory/2232-1-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp

Filesize
9.9MB

Download
memory/2232-2-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download
memory/2232-3-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp

Filesize
9.9MB

Download
memory/2232-4-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download