66ac205d7b9a649bfa7b8606be0c44756b405e365113c1f17f31981d8a62ec2f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:01

Target

0f7c2e6ea50956308e212160f5824bf0.exe
Size

9KB
MD5

0f7c2e6ea50956308e212160f5824bf0
SHA1

ea9e48abc35b552436661cd19009b41a0bc9882f
SHA256

66ac205d7b9a649bfa7b8606be0c44756b405e365113c1f17f31981d8a62ec2f
SHA512

316fcc11848597eb0f08d39e90d92b49d95017d9769e361888361004a9969f0cd71cf19804de58d998f0d39c399e661a3f4d26041656af600854654034549158
SSDEEP

192:qBksu7rN3y+XpeMZZ3k93VnjdwCzDR3QycJU/b:RZhpeMAFnhwCBAycJU/

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	0f7c2e6ea50956308e212160f5824bf0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2792	3004	0f7c2e6ea50956308e212160f5824bf0.exe	28
PID 3004 wrote to memory of 2792	3004	0f7c2e6ea50956308e212160f5824bf0.exe	28
PID 3004 wrote to memory of 2792	3004	0f7c2e6ea50956308e212160f5824bf0.exe	28

C:\Users\Admin\AppData\Local\Temp\0f7c2e6ea50956308e212160f5824bf0.exe
"C:\Users\Admin\AppData\Local\Temp\0f7c2e6ea50956308e212160f5824bf0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3004 -s 896
  2⤵
  PID:2792

memory/3004-0-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/3004-1-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-2-0x000000001B6D0000-0x000000001B750000-memory.dmp

Filesize
512KB

Download
memory/3004-3-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-4-0x000000001B6D0000-0x000000001B750000-memory.dmp

Filesize
512KB

Download