71fe42bea55c3703ce4e30aa0b17568fdf959061b060a164b095296cf1666ec1

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:20

Target

107954e1ff835f9a31268b164fad01b3.exe
Size

756KB
MD5

107954e1ff835f9a31268b164fad01b3
SHA1

e9bd85e89cc1f1e6ee4b887612b9c7efdb573b4a
SHA256

71fe42bea55c3703ce4e30aa0b17568fdf959061b060a164b095296cf1666ec1
SHA512

2cd54c34814b5af4cc017c707334f75a189dc6f54704f24dfade8d3908c654acbcb55f04fc4ef409bd34f15e1031f731f2369a7a1fe7b1dc6423434fe432b4b8
SSDEEP

12288:sQlkgu2kPOI2xj/u2JT5x2Ha8WmQE1qFodzBQJuesvAX97BYIw:8WkPOI2x//zYHa8WmQEQyoErINBYI

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2972	svchost.exe

Loads dropped DLL 5 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	2972	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1736	107954e1ff835f9a31268b164fad01b3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2972	1736	107954e1ff835f9a31268b164fad01b3.exe	28
PID 1736 wrote to memory of 2972	1736	107954e1ff835f9a31268b164fad01b3.exe	28
PID 1736 wrote to memory of 2972	1736	107954e1ff835f9a31268b164fad01b3.exe	28
PID 1736 wrote to memory of 2972	1736	107954e1ff835f9a31268b164fad01b3.exe	28
PID 2972 wrote to memory of 2856	2972	svchost.exe	29
PID 2972 wrote to memory of 2856	2972	svchost.exe	29
PID 2972 wrote to memory of 2856	2972	svchost.exe	29
PID 2972 wrote to memory of 2856	2972	svchost.exe	29

\Users\Admin\AppData\Roaming\svchost.exe

Filesize
756KB

MD5
107954e1ff835f9a31268b164fad01b3

SHA1
e9bd85e89cc1f1e6ee4b887612b9c7efdb573b4a

SHA256
71fe42bea55c3703ce4e30aa0b17568fdf959061b060a164b095296cf1666ec1

SHA512
2cd54c34814b5af4cc017c707334f75a189dc6f54704f24dfade8d3908c654acbcb55f04fc4ef409bd34f15e1031f731f2369a7a1fe7b1dc6423434fe432b4b8

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
512KB

MD5
41f127b05265ec0659f61f70607e9b82

SHA1
e4a791e8ac1c547900bf90b6bac6d5a6753957a8

SHA256
b12340b7f991ce13821ce0fabad6f4b9615e9be58a6dbe175ab0400772c5e710

SHA512
a782ad5339de14b869105162a2b0b799af361183ea2d04068865518723c6552f865458ad8b5b418827934e64e44ee8d6f98fad93bdeeb0c834fbe9cd8669616e

Download Submit
memory/1736-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1736-9-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2972-10-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2972-14-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download